An unauthenticated SQL injection vulnerability in the miniOrange Custom API for WP plugin exposes the application to potential data exfiltration.

This is an SQL injection vulnerability (CWE-89) that requires no authentication, enabling an attacker to inject malicious SQL commands via the application's API endpoints.

The vulnerability allows attackers to query the database, potentially leading to the unauthorized disclosure of user credentials, site configuration, or other sensitive business information. The high CVSS score of 9.3 underscores the necessity of immediate remediation to prevent potential data breaches.

Immediate Action: Update the Custom API for WP plugin to version 4.2.3 or later.

Proactive Monitoring: Review web server access logs for anomalous requests directed at API endpoints, particularly those containing SQL-related keywords.

Compensating Controls: Utilize a WAF to filter and block malicious API requests attempting to manipulate SQL queries.

Public Exploit Available: Unknown — no confirmed public weaponized exploit or curated PoC was identified in the provided data.

All administrators using the Custom API for WP plugin must update to the latest version immediately. Failure to patch leaves the underlying database exposed to remote, unauthenticated attackers.