A critical SQL injection vulnerability in the MDTF WordPress plugin allows unauthenticated attackers to execute arbitrary database commands, risking sensitive data exposure.

The plugin contains an Improper Neutralization of Special Elements used in an SQL Command (CWE-89) vulnerability. This flaw allows an unauthenticated attacker to inject malicious SQL queries through the plugin's interface.

The CVSS score of 9.3 highlights the potential for significant data breaches and unauthorized database access. While the CVSS score is high, it reflects the ability of an unauthenticated attacker to manipulate database queries, potentially leading to the exposure of WordPress user data or administrative credentials.

Immediate Action: Update the MDTF – Meta Data and Taxonomies Filter plugin to version 1.3.3.8 or later immediately.

Proactive Monitoring: Review database query logs for anomalous activity or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the confidentiality of the underlying WordPress database. Administrators should prioritize the update to version 1.3.3.8 to remediate this flaw and prevent potential unauthorized access to sensitive application data.