# SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai

Unauthenticated SQL injection in the tenweb-speed-optimizer WordPress plugin's compress-one REST endpoint chained with insecure deserialization to achieve remote code execution on krisp.ai.

- Payout: hidden
- Severity: critical
- Program: Krisp
- Found by: mikemyers
- Disclosed: 2023-02-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1842674
- Library page: https://bugbountylibrary.com/r/h1%3A1842674
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:php tech:wordpress technique:chained vuln:deserialization vuln:rce vuln:sqli

**Target:** WordPress plugin tenweb-speed-optimizer REST endpoint /wp-json/tenwebio/v2/compress-one
**Root cause:** The tenweb-speed-optimizer plugin (prior to 2.12.22) exposed an unauthenticated SQL injection in the compress-one REST endpoint; the plugin also contained insecure deserialization that could be reached once SQLi was achieved.
**Steps:**
1. Identify WordPress site krisp.ai running tenweb-speed-optimizer plugin < 2.12.22
2. Send unauthenticated request to `/wp-json/tenwebio/v2/compress-one` with SQL injection payload
3. Use SQLi to inject a malicious serialized payload into a location the plugin later deserializes
4. Trigger deserialization to execute arbitrary code (RCE)
**Exploitation:** Unauthenticated attacker exploits SQLi in the compress-one endpoint to plant a crafted serialized object, then triggers the plugin's insecure deserialization to execute arbitrary PHP code on the host.
**Escalation:** SQL injection chained into insecure deserialization to escalate from data access to remote code execution.
**Insight:** WordPress plugin REST endpoints under /wp-json/<vendor>/v2/ are frequently unauthenticated; check plugin changelogs for SQLi fixes and look for deserialization sinks that can be reached by writing attacker-controlled data via SQLi.