An unauthenticated SQL Injection vulnerability in the Supsystic Membership plugin for WordPress allows attackers to potentially access or manipulate the application's database.

The plugin fails to properly neutralize special elements used in an SQL command (CWE-89). An unauthenticated attacker can inject malicious SQL queries via the 'sidx' parameter, allowing unauthorized database interactions.

Successful exploitation can lead to unauthorized access to sensitive information stored in the WordPress database, including user credentials and site configuration data. The CVSS score of 8.2 classifies this as a high-severity risk that could lead to full data exfiltration or site compromise.

Immediate Action: Update the Supsystic Membership plugin to the latest version. If a patch is not currently available, deactivate the plugin until remediation is confirmed.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that suggest attempted SQL injection attacks.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads in incoming HTTP requests.

Public Exploit Available: Yes — an ExploitDB entry exists.

SQL injection is a critical vulnerability that can result in total data loss or unauthorized access. Administrators must take immediate action to patch or disable the affected software to minimize the attack surface.