A critical SQL injection vulnerability in the Miguel Useche JS Archive List plugin allows unauthenticated attackers to manipulate database queries and potentially compromise sensitive data.

This is an SQL Injection (SQLi) vulnerability caused by the failure to properly sanitize user-supplied input before using it in SQL commands. This allows an attacker to interact directly with the underlying database.

A CVSS score of 9.3 underscores the high severity of this flaw, which can lead to unauthorized data exfiltration, database corruption, or complete loss of administrative control over the WordPress instance. The impact on business continuity and data privacy is substantial, as attackers can bypass authentication and access private records.

Immediate Action: Update the JS Archive List plugin to the latest version. If a patch is unavailable, deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Check database logs for suspicious queries, particularly those containing SQL syntax characters (e.g., ', --, UNION).

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

SQL injection remains one of the most dangerous web vulnerabilities. Security teams must prioritize updating the affected plugin and auditing the WordPress environment for signs of unauthorized database interaction to ensure the integrity of the application.