A high-severity SQL injection vulnerability in the mojoomla WPGYM plugin allows authenticated attackers to compromise database integrity and potentially access sensitive information.

This vulnerability is a classic SQL injection (CWE-89) triggered by improper input sanitization. The CVSS vector indicates that while the attack is network-based, it requires low-level user privileges to execute.

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to the unauthorized disclosure of sensitive user data or system information. Given the CVSS score of 8.5, this vulnerability represents a significant risk to data confidentiality and application stability, which could lead to severe reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate and remove the WPGYM plugin from all WordPress installations until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected use of UNION or SLEEP commands, which are common indicators of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeted at WordPress plugins.

Public Exploit Available: Unknown.

Due to the high CVSS score and the nature of SQL injection vulnerabilities, the risk posed by this plugin is substantial. Administrators must prioritize the removal of the vulnerable WPGYM plugin from their environments immediately, as no patch is currently available to remediate the underlying code flaw.