CVE-2023-52201 is a high severity (7.6 CVSS) SQL injection flaw in the pTypeConverter plugin for WordPress, in versions through 0.2.8.1. Patchstack says it can be reached by an account at the Editor role. Neither the record nor the Patchstack page we read names a patched version, so check the plugin page before relying on any update.
What's affected
The NVD record covers pTypeConverter from Brian D. Goad, all versions through 0.2.8.1. The weakness is CWE-89 (SQL Injection), described as improper neutralization of special elements used in an SQL command.
The two sources describe the needed privilege differently. The CVSS vector in the record marks privileges required as high, while Patchstack lists the Editor role. Plan for the stricter reading of whichever applies on your site: anyone who can hold that role, or who can take over such an account, is the relevant population.
No patched release is named. Treat every version of the plugin as affected until the vendor or Patchstack says otherwise.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get ptypeconverter --field=version
The slug ptypeconverter comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 0.2.8.1 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then look at who holds the Editor role or higher:
wp user list --role=editor --fields=ID,user_login,user_registered
An unexpected account, or one created recently, deserves a closer look before you touch anything else.
What to do now
- Back up the site and its database.
- If you can, deactivate and delete pTypeConverter. If you need it, limit who holds the Editor role until a fix appears, and watch the plugin page for a release.
- Review accounts with the Editor role or above and remove any you do not recognise.
- Rotate database credentials and administrator passwords if you see signs of misuse.
- Enable query and error logging at your host if you can, and look for unexpected database errors.
Why it matters
SQL injection happens when input reaches a database query without being separated from the query's structure. The usual cure is parameterized queries, which keep data and commands apart. The advisory does not describe the vulnerable parameter and we will not guess at it.
The vector in the record scores confidentiality impact as high, so the concern is reading data from the WordPress database, which can include user records and stored settings. The scope is marked changed, meaning the effect can reach beyond the plugin itself. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Quick check
Is this exploitable by anyone on the internet?
Not according to Patchstack. It lists the Editor role as required, so the attacker needs an account at that level first. That is a lower bar than administrator and still worth closing.
What if no fix exists for my version?
Remove the plugin or replace it with a maintained alternative. If you must keep it, restrict who holds elevated roles and watch for a vendor release.
Sources
Last reviewed: 19 October 2026.
