An SQL injection vulnerability in the AmentoTech Workreap plugin allows authenticated attackers to potentially exfiltrate sensitive database information.

This is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89). The flaw requires low-level privileges (authenticated) to successfully inject malicious SQL queries into the database backend.

Successful exploitation allows attackers to manipulate database queries, potentially leading to unauthorized data exposure or system disruption. While the CVSS score is 9.8, the requirement for authenticated access slightly tempers the immediate risk compared to unauthenticated vectors, though the impact remains critical for data security.

Immediate Action: As no patch is currently available, it is recommended to deactivate the Workreap plugin until the vendor releases a secure update.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax or unusual patterns that may indicate injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection enabled to inspect and filter malicious payloads targeting the application's database.

Public Exploit Available: Unknown

Organizations should immediately disable the Workreap plugin to mitigate the risk of database compromise. Until an official patch is provided, security teams should focus on auditing user accounts to ensure no unauthorized access is being leveraged to trigger this vulnerability.