The AutomatorWP WordPress plugin is vulnerable to a SQL injection flaw that could allow a high-privileged attacker to compromise database confidentiality and availability.

This vulnerability is a SQL injection (CWE-89) arising from improper neutralization of special elements used in an SQL command. The CVSS vector indicates that exploitation requires high privileges (PR:H) and occurs over the network (AV:N).

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data within the WordPress database. Given the CVSS score of 7.6, the risk is classified as High, as it poses a significant threat to data integrity and system stability, potentially leading to unauthorized information disclosure or service disruption.

Immediate Action: Monitor the vendor advisory for the release of an official security update and apply it as soon as it becomes available. If no patch is provided, consider temporarily disabling the plugin if it is not business-critical.

Proactive Monitoring: Review database audit logs for anomalous or unauthorized query patterns, specifically those containing suspicious SQL syntax. Monitor for unusual spikes in database load or unexpected access to sensitive tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns. Ensure that database user permissions follow the principle of least privilege to limit the potential impact of a successful injection.

Public Exploit Available: No (exploit_available: false).

Organizations utilizing the AutomatorWP plugin must prioritize the identification of the affected version in their environment. While active exploitation is not currently reported, the high CVSS score necessitates vigilance and the immediate application of vendor-supplied security patches once released to minimize the risk of unauthorized database manipulation.