An SQL injection vulnerability in the WP Links Page WordPress plugin allows authenticated attackers to potentially access sensitive database information.

The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries, which constitutes a CWE-89 SQL injection vulnerability. Based on the CVSS vector PR:L, this flaw requires the attacker to have at least low-level authenticated access to the application to trigger the malicious payload.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information stored within the WordPress database. Given the CVSS score of 8.5, this is classified as a High severity issue, as it may allow an attacker to bypass standard application logic and gain insight into the underlying data structure or user records.

Immediate Action: There is no official patch currently available; users should immediately deactivate and remove the WP Links Page plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review database query logs for anomalous syntax, such as unexpected UNION or SLEEP commands, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the WordPress environment.

Public Exploit Available: Unknown.

Due to the high CVSS score and the nature of SQL injection, this vulnerability poses a significant risk to data confidentiality. Administrators are strongly advised to remove the affected plugin immediately to eliminate the attack surface, as no vendor patch is available to remediate the flaw at this time.