A high-severity SQL injection vulnerability in the Metagauss ProfileGrid plugin exposes backend databases to potential unauthorized access by authenticated users.

The vulnerability is a SQL injection (CWE-89) arising from the improper neutralization of special elements in SQL commands. The CVSS vector indicates that an attacker requires low privileges (PR:L) to trigger this flaw, meaning any authenticated user can exploit the vulnerability to potentially access sensitive database information.

Successful exploitation of this flaw could lead to the unauthorized disclosure of sensitive user data or system information stored within the WordPress database. Given the CVSS score of 8.5, this is a high-risk issue that could result in significant data breaches and compromise the integrity of the affected application.

Immediate Action: Monitor the vendor’s official channels for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Review database query logs for anomalous patterns or unauthorized SQL syntax that may indicate an attempt to exploit this injection vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing the ProfileGrid plugin should treat this vulnerability with high priority. Although no patch is currently identified in the enrichment data, administrators should audit user roles to ensure only trusted individuals have access to the platform, thereby limiting the pool of potential attackers who could trigger this vulnerability. Apply the forthcoming vendor update immediately upon release.