A critical SQL injection vulnerability in the Supsystic Pricing Table plugin allows unauthenticated attackers to potentially access sensitive database information.

This vulnerability is an SQL injection (CWE-89) flaw occurring within the plugin's data processing logic. It allows an unauthenticated, remote attacker to execute arbitrary SQL commands against the WordPress database.

The vulnerability carries a CVSS score of 8.2, reflecting its potential for high confidentiality impact. A successful exploit could lead to the unauthorized extraction of database content, including user credentials or sensitive site configuration data, significantly compromising the integrity and privacy of the affected WordPress site.

Immediate Action: Administrators should immediately disable or uninstall the Supsystic Pricing Table plugin until a verified security patch is confirmed and applied.

Proactive Monitoring: Review database query logs for unusual syntax or unexpected patterns originating from external IP addresses that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49533).

Given the availability of public exploit code and the ease of exploitation (unauthenticated), this vulnerability poses a significant risk to site security. Administrators must prioritize the removal of the vulnerable plugin version to prevent unauthorized database access.