The miniOrange Custom API for WordPress plugin is vulnerable to SQL injection, posing a critical risk of unauthorized database access and potential remote code execution.

This vulnerability is an SQL injection flaw resulting from improper neutralization of special elements in database queries. The vulnerability is exploitable by unauthenticated attackers, allowing them to manipulate backend database operations.

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, modify database contents, or potentially gain administrative access to the WordPress environment. Given the high CVSS score of 9.3, this vulnerability represents a significant risk to data confidentiality and system integrity.

Immediate Action: Identify and update the miniOrange Custom API for WP plugin to the latest vendor-supplied version immediately.

Proactive Monitoring: Review web server and database logs for unusual query patterns, such as unexpected UNION SELECT statements or syntax errors indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns to mitigate risk until the plugin is updated.

Public Exploit Available: Unknown

Organizations utilizing the miniOrange Custom API for WordPress must prioritize updating this plugin to the latest version. SQL injection is a severe vulnerability that can lead to complete compromise of the application and its underlying data.