The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdata[commentcount] parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on : and both halves are interpolated directly into a postswhere SQL clause without intval() casting or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wpusers.userlogin, and wpusers.userpass).