A Blind SQL Injection vulnerability in the BWL Pro Voting Manager plugin allows authenticated users to access or manipulate sensitive database information.

This is a Blind SQL Injection vulnerability arising from improper neutralization of special elements in SQL commands. It requires the attacker to have at least low-level authenticated access to the application.

While the attack requires authentication, a successful exploit could allow an attacker to dump sensitive database contents, including user credentials or private configuration data. The CVSS score of 9.8 highlights the severity of potential data compromise, though the requirement for authentication reduces the immediate risk compared to unauthenticated vectors.

Immediate Action: As no patched version is currently available, administrators should deactivate and uninstall the BWL Pro Voting Manager plugin until a fix is released by the developer.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that may indicate automated SQL injection attempts.

Compensating Controls: Ensure that the database user account utilized by the WordPress application adheres to the principle of least privilege to limit the scope of potential data exfiltration.

Public Exploit Available: Unknown

Given the lack of a current patch, the recommended course of action is to remove the vulnerable plugin from the environment. Administrators should prioritize identifying alternative solutions or waiting for the vendor to address the flaw in a future release.