A SQL injection vulnerability in the Aman Funnel Builder plugin for WordPress, affecting versions up to 3.10.2, poses a significant risk of unauthorized database access.

The plugin fails to properly neutralize special elements in SQL commands, which allows an authenticated attacker with high-level privileges (PR:H) to perform SQL injection. The flaw exists within the funnel-builder component and permits unauthorized read access to the database.

This vulnerability allows an attacker to interact with the underlying database, potentially leading to the exposure of sensitive customer data or configuration information. Given the CVSS score of 7.6, this is classified as a High severity issue that requires immediate attention to prevent potential data breaches or unauthorized administrative actions.

Immediate Action: Since a specific patch is not yet confirmed, administrators should deactivate the Funnel Builder plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review database query logs for unusual or unexpected syntax patterns originating from the plugin administrative interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false)

Given the High severity rating, organizations must prioritize this vulnerability by monitoring vendor release channels for a security update. Until a fix is available, deactivation of the affected plugin is the most effective method to eliminate the risk of exploitation.