ExpressionEngine · Report #3249794
SQL injection in structure plugin
Validstatus
mediumseverity
125upvotes
26 Jan 2026disclosed
Summary
Title: SQL Injection in Structure Plugin Vulnerability: An SQL injection flaw was discovered in ExpressionEngine's Structure plugin, specifically in the delete_channels() function. User input from the channel_ids parameter is passed directly into SQL queries without proper sanitization. Although the vulnerability requires admin panel access, a limited-privilege admin could exploit it
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.