An unauthenticated SQL injection vulnerability in the JS Archive List plugin poses a critical risk of database information disclosure.

This vulnerability is a classic SQL Injection (CWE-89) triggered by improper input sanitization, allowing unauthenticated remote attackers to manipulate database queries.

Successful exploitation allows an attacker to bypass security controls to potentially exfiltrate sensitive data from the WordPress database. While the CVSS score of 9.3 reflects a critical severity, the actual business impact depends on the sensitivity of the data stored within the underlying site database.

Immediate Action: Update the JS Archive List plugin to version 6.1.6 or later immediately.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that suggest automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns (e.g., union-based or boolean-based injection attempts).

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Given the ease of exploitation for SQL injection vulnerabilities and the availability of a public proof-of-concept, users should prioritize patching this plugin immediately. Organizations unable to update should deactivate the plugin until a secure version is deployed.