The Contact Us page - Contact people LITE plugin contains a SQL injection vulnerability that allows authenticated attackers to potentially exfiltrate sensitive database information.

The plugin fails to properly neutralize special elements in SQL commands. The CVSS vector indicates that an attacker with low privileges (authenticated) can trigger this flaw through a network-based attack vector.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying WordPress database. Given the CVSS score of 8.5, this is a high-severity issue that could result in the disclosure of sensitive user information, administrative credentials, or other critical application data.

Immediate Action: As there is no confirmed patch available at this time, administrators should immediately deactivate and remove the Contact Us page - Contact people LITE plugin until a secure version is released by the vendor.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts targeting the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while the plugin remains inactive.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the lack of an available patch, necessitates immediate action to secure the environment. Organizations should prioritize deactivating the affected plugin and assessing the database for any signs of unauthorized access or data modification.