A high-severity SQL injection vulnerability in the Alexander AnyComment plugin allows authenticated attackers to compromise database confidentiality and integrity.

The vulnerability is a SQL injection flaw (CWE-89) triggered by improper neutralization of special elements in database queries. Based on the CVSS vector (PR:L), this attack requires the attacker to hold low-level authenticated privileges to successfully exploit the vulnerable component.

This vulnerability poses a significant risk to data confidentiality and availability, as SQL injection can allow an attacker to bypass security controls to access, modify, or delete sensitive application data. With a CVSS score of 8.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration or potential service disruption.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable or uninstall the AnyComment plugin until a secure update is provided by the vendor.

Proactive Monitoring: Security teams should review web server and database logs for anomalous query patterns, such as unexpected SQL syntax or unauthorized access attempts originating from authenticated user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide a layer of protection while the plugin remains inactive or pending a fix.

Public Exploit Available: No — there is no confirmed public exploit available in our curated sources.

Given the high CVSS score and the nature of SQL injection, the risk to the application environment is severe. We recommend that administrators immediately disable the AnyComment plugin to eliminate the attack surface and monitor vendor channels for the release of a patched version.