A critical SQL injection vulnerability in the Perfect Brands for WooCommerce plugin could allow authenticated attackers to access sensitive database information.

The plugin fails to properly sanitize input before using it in SQL queries, resulting in a classic SQL injection flaw. Based on the CVSS vector (PR:L), this vulnerability is exploitable by any authenticated user, such as a subscriber or customer, to perform unauthorized database operations.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive business and customer data stored within the WordPress database. Given the CVSS score of 8.5, this is considered a high severity risk that could result in significant data breaches or compromised system integrity, requiring immediate attention.

Immediate Action: Since a specific patch version is not explicitly confirmed, administrators should check the vendor website for the latest version and update the plugin immediately. If no update is available, consider deactivating or removing the plugin until a secure version is released.

Proactive Monitoring: Security teams should review database query logs for unusual patterns or suspicious SQL syntax originating from authenticated user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts against WordPress plugins.

Public Exploit Available: Unknown.

The vulnerability poses a substantial risk to data confidentiality and should be prioritized by IT security teams. Administrators must verify if their current installation falls within the affected range and apply the latest security updates provided by the vendor to prevent unauthorized database access.