A critical SQL injection vulnerability in the RealMag777 MDTF plugin for WordPress allows unauthenticated attackers to execute arbitrary SQL commands against the database.

This vulnerability occurs because the MDTF plugin fails to properly sanitize user-supplied input before including it in SQL queries. An unauthenticated attacker can leverage this flaw to manipulate database queries, potentially leading to unauthorized data access or modification.

With a CVSS score of 9.3, this SQL injection flaw poses a severe risk to data confidentiality and integrity. Successful exploitation could allow attackers to bypass authentication, extract sensitive customer information, or delete database contents, leading to significant regulatory compliance failures and loss of consumer trust.

Immediate Action: Update the MDTF plugin to the latest version available from the vendor, ensuring all security fixes are applied.

Proactive Monitoring: Inspect database query logs for suspicious SQL syntax or anomalous patterns that deviate from standard application behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured with SQL injection protection rules to filter malicious requests targeting the plugin.

Public Exploit Available: Unknown

Given the high CVSS score, this vulnerability represents an urgent risk to any WordPress environment utilizing the MDTF plugin. Administrators must verify their installed version and apply the necessary updates immediately to secure their database and prevent unauthorized data access.