The Wp tabber widget plugin for WordPress contains an SQL injection vulnerability that allows authenticated attackers to potentially exfiltrate sensitive database information.

This vulnerability is a classic SQL injection flaw (CWE-89) triggered by the improper neutralization of special elements within SQL commands. The CVSS vector (PR:L) indicates that an attacker must possess low-level authenticated access to the target WordPress installation to trigger the flaw.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive data stored within the WordPress database. Given the CVSS score of 8.5, this represents a high-severity risk that could result in the compromise of user credentials, configuration details, or other proprietary information, leading to potential regulatory non-compliance and reputational harm.

Immediate Action: Since a specific patch is not currently identified, administrators should immediately deactivate and remove the Wp tabber widget plugin from their environments until a secure version is released by the developer.

Proactive Monitoring: Review database query logs for unusual patterns or syntax, particularly queries originating from the plugin or associated with low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while the plugin remains unpatched.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of SQL injection, this vulnerability poses a severe risk to the confidentiality of the underlying database. Organizations currently utilizing the Wp tabber widget should prioritize the immediate removal or deactivation of the plugin until an official update is available to remediate the flaw.