A critical SQL injection vulnerability in the Library Management System plugin for WordPress allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.

This flaw is a SQL injection vulnerability (CWE-89) triggered by the lack of input sanitization and parameterization on the bid parameter. Unauthenticated attackers can manipulate SQL queries to bypass security controls and access unauthorized database content.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality. Attackers could potentially dump entire database tables, leading to the exposure of user credentials, personal information, or sensitive library records. With a CVSS score of 7.5, this high-severity vulnerability necessitates immediate attention to prevent potential data breaches and regulatory non-compliance.

Immediate Action: Update the Library Management System plugin to the latest available version that includes the security patch. If a patched version is not immediately available, disable or remove the plugin from the WordPress environment until a fix is verified.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected UNION SELECT statements or unauthorized access attempts targeting the bid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Given the ease with which unauthenticated attackers can leverage this SQL injection flaw, organizations must prioritize patching the Library Management System plugin immediately. Administrators should verify the plugin version and apply updates to version 3.2.1 or higher to ensure the vulnerability is neutralized. Failure to address this flaw leaves the database exposed to unauthorized data extraction.