Blind sql injuction in Wordpress

Blind sql injuction in Wordpress : (‪#‎DH‬)

Lets take a look into the new yoad vulnerability
in wordpress:

web hacking, wordPress hacking, SQL Injuction for WordPress.

The discovered flaw resides in 'admin/class- bulk-editor-list-table.php' file, which is authorized to be accessed by WordPress Admin,
Editor or Author privileged users only.
Attack vector:
To exploit this, attacker needs to trigger the exploit from authorized users only. This can be achieved with the help of social engineering,
where an attacker can trick authorized user to click on a specially crafted payload exploitable URL.
Payload of Blind SQL Injection vulnerability in ‘WordPress SEO by Yoast’,
which is as follows:
''
http://victim-wordpress-website.com/wp-
admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c (select%20*%20from%20(select(sleep(10)))a)&or
der=asc
''
Solution:
WordPress SEO by Yoast (1.7.4) by Yoast
WordPress plugin has patched this.
If you have installed WordPress 3.7 versio
n and above, then you can enable fully automate updating of your plugins and themes from
Manage > Plugins & Themes > Auto Updates tab.