HexBrain

ExpressionEngine · Report #3249794

SQL injection in structure plugin

Validstatus
mediumseverity
125upvotes
26 Jan 2026disclosed

Summary

Title: SQL Injection in Structure Plugin Vulnerability: An SQL injection flaw was discovered in ExpressionEngine's Structure plugin, specifically in the delete_channels() function. User input from the channel_ids parameter is passed directly into SQL queries without proper sanitization. Although the vulnerability requires admin panel access, a limited-privilege admin could exploit it

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original