Case: Scoping the DB User Turned a SQLi Into a Dead End

Case: Scoping the DB User Turned a SQLi Into a Dead End
Pen test found a SQL-injectable plugin endpoint. The DB user had FILE and GRANT, so the finding was rated critical: full DB dump plus file write.

Database least-privilege SOP:

— Step 1: Create an app-only DB user with SELECT, INSERT, UPDATE, DELETE on that schema only.
— Step 2: Revoke FILE, GRANT, DROP, ALTER, CREATE.
— Step 3: Remove access to all other databases on the server.
— Step 4: Run the migration/install once as a privileged user, then swap wp-config to the scoped user.
— Step 5: Re-run the pen test against the same endpoint.

Outcome: Same injectable endpoint, re-rated: the FILE-based shell-write path was gone, the cross-DB read was gone. Finding dropped from critical to medium. We still patched the plugin — but the blast radius was already capped.

Run this every time.