A critical SQL injection vulnerability in the Asgaros Forum plugin allows unauthenticated attackers to extract sensitive data from the underlying WordPress database.

This flaw is an SQL injection vulnerability (CWE-89) triggered by insufficient escaping on the user-supplied asgarosforum_unread_exclude cookie. It allows an unauthenticated attacker to manipulate database queries to exfiltrate sensitive information.

Successful exploitation of this vulnerability poses a significant risk to data confidentiality, as it permits unauthorized access to database contents. Given the CVSS score of 7.5, this is classified as a high-severity issue that could lead to the exposure of user credentials, personal information, or sensitive configuration data, potentially resulting in full site compromise or regulatory non-compliance.

Immediate Action: Administrators should audit their WordPress installation and disable or remove the Asgaros Forum plugin until a verified patch or security update is released by the vendor.

Proactive Monitoring: Security teams should monitor database logs for unusual query patterns or unexpected error messages that may indicate attempted SQL injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malformed cookie inputs and detect common SQL injection patterns.

Public Exploit Available: Unknown

The risk posed by this vulnerability is high due to the lack of required authentication for an attacker to access the database. Because the vulnerability is directly accessible through a common cookie parameter, organizations should prioritize the removal or isolation of the affected plugin immediately to prevent potential data exfiltration.