CVE-2015-6522

WP Symposium < 15.7 - SQL Injection via Size Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-6522. PoCs published by PizzaHatHacker, including Metasploit module auxiliary/admin/http/wp_symposium_sql_injection.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress plugin wp-symposium (versions up to 15.5.1). The vulnerability is exploited via the 'size' parameter in get_album_item.php, allowing an attacker to retrieve database content, including user details and password hashes.

Description

SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.

Exploits (2)

exploitdb WORKING POC
by PizzaHatHacker · textwebappsphp
https://www.exploit-db.com/exploits/37824

This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress plugin wp-symposium (versions up to 15.5.1). The vulnerability is exploited via the 'size' parameter in get_album_item.php, allowing an attacker to retrieve database content, including user details and password hashes.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: wp-symposium WordPress plugin <= 15.5.1
No auth needed
Prerequisites: WordPress installation with vulnerable wp-symposium plugin
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by PizzaHatHacker · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_symposium_sql_injection.rb

This Metasploit module exploits a SQL injection vulnerability in the WP Symposium plugin for WordPress, allowing remote attackers to extract user credentials via the 'size' parameter in get_album_item.php. It automates the retrieval of user IDs and credentials by injecting SQL queries.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WordPress WP Symposium Plugin before 15.8
No auth needed
Prerequisites: Target must have WP Symposium plugin version < 15.8 installed · Access to the get_album_item.php endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/37824/
Exploit, Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/8140

Scores

EPSS 0.7982
EPSS Percentile 99.1%

Details

CWE
CWE-89
Status published
Products (1)
wpsymposium/wp_symposium < 15.7
Published Aug 19, 2015
Tracked Since Feb 18, 2026