The Learts Addons plugin for WordPress is vulnerable to unauthenticated SQL injection, posing a critical risk of database information disclosure.

This is a SQL injection vulnerability (CWE-89) where the plugin fails to properly sanitize user-supplied input. The CVSS vector (AV:N/AC:L/PR:N) confirms that an unauthenticated attacker can execute this exploit remotely without requiring prior access or interaction.

Successful exploitation allows an attacker to interact directly with the underlying database, potentially leading to the unauthorized exfiltration of sensitive configuration data or user information. While the CVSS score of 9.3 highlights a critical severity, the impact is primarily focused on data confidentiality and limited system availability, which could disrupt business operations and compromise customer trust.

Immediate Action: Update the Learts Addons plugin to version 1.7.5 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected UNION SELECT statements or syntax errors that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for unauthorized data access, all administrators using the Learts Addons plugin must prioritize updating to version 1.7.5. Failure to apply this patch leaves the application exposed to remote attackers capable of extracting sensitive database contents.