The PressTigers ZIP Code Based Content Protection plugin contains a critical SQL injection vulnerability that permits unauthorized database interaction by authenticated users.

This vulnerability is a classic SQL injection (CWE-89) arising from the improper neutralization of special elements within database queries. The CVSS vector (PR:H) indicates that an attacker must possess administrative privileges to trigger the flaw, though the resulting impact allows for unauthorized data access and potential service disruption.

Successful exploitation of this SQL injection flaw could lead to the unauthorized extraction of sensitive information from the underlying database, potentially compromising user data or proprietary content. With a CVSS score of 7.6, the vulnerability represents a high risk, as it grants attackers the ability to manipulate database operations, which may result in significant reputational damage or unauthorized system access.

Immediate Action: Since no official patch is currently identified, administrators should immediately deactivate and uninstall the ZIP Code Based Content Protection plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review database query logs for suspicious patterns, such as unusual syntax or unexpected access to sensitive tables, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads, providing a layer of protection if the plugin must remain active in a restricted environment.

Public Exploit Available: No (exploit_available: false)

Given the severity of SQL injection vulnerabilities and the potential for database compromise, this issue should be treated with high priority. Organizations are strongly advised to remove the vulnerable software component from their production environments immediately and monitor for any signs of unauthorized database activity until the vendor provides a verified security update.