A critical SQL injection vulnerability in the Presstigers ZIP Code Based Content Protection plugin for WordPress allows unauthenticated attackers to extract sensitive database information.

This vulnerability is a SQL injection flaw (CWE-89) located in the zipcode parameter, caused by insufficient input sanitization and lack of prepared statements. It permits unauthenticated remote attackers to execute arbitrary SQL queries against the underlying database.

The ability for an unauthenticated attacker to inject SQL queries poses a severe risk to data confidentiality, as it enables the unauthorized exfiltration of sensitive information from the WordPress database. With a CVSS score of 7.5, this high-severity flaw could lead to significant data breaches, regulatory non-compliance, and loss of intellectual property if left unaddressed.

Immediate Action: Since a specific patched version is not explicitly identified in the provided data, administrators should immediately deactivate and remove the ZIP Code Based Content Protection plugin until a secure update is confirmed by the vendor.

Proactive Monitoring: Review database access logs and query execution logs for anomalous activity or unexpected syntax patterns originating from public-facing endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection rules to block malicious requests targeting the zipcode parameter.

Public Exploit Available: No (no confirmed public exploit in the available data).

Given the high CVSS score and the potential for unauthenticated database compromise, organizations must treat this vulnerability with urgency. Administrators should prioritize the removal of the affected plugin from all production environments immediately, as no confirmed patch is currently available to mitigate the underlying code flaw.