The Pakke Envíos plugin for WordPress contains an SQL injection vulnerability that allows authenticated attackers to access sensitive database information.

This vulnerability is a classic SQL injection (CWE-89) flaw where the application fails to properly sanitize special elements in SQL commands. It requires a low-privilege authenticated user to trigger the malicious queries against the database.

Successful exploitation of this vulnerability could lead to the unauthorized extraction of sensitive data from the underlying database, including user credentials or configuration details. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to a full compromise of the application data layer.

Immediate Action: Since a specific patch is not currently listed, administrators should immediately disable or remove the Pakke Envíos plugin until the vendor releases a secure version.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection strings and patterns targeting WordPress plugins.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of SQL injection, organizations using the Pakke Envíos plugin should treat this vulnerability with urgency. If the plugin is not essential for business operations, the most secure course of action is to uninstall it immediately to eliminate the attack surface.