An authenticated SQL injection vulnerability in the Unicamp theme poses a critical threat to database confidentiality and integrity for affected WordPress sites.

The theme fails to properly sanitize input in specific parameters, allowing a user with subscriber-level access to inject malicious SQL commands into the backend database.

Successful exploitation allows an attacker to bypass access controls, extract sensitive user information, or modify site data. With a CVSS score of 8.5, this vulnerability represents a severe risk to data privacy and could lead to significant reputational and operational damage if databases are compromised.

Immediate Action: Update the Unicamp theme to the latest version, ensuring all security patches are applied.

Proactive Monitoring: Review database query logs for suspicious patterns or anomalous syntax indicative of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests for SQL injection patterns and restrict user registration if it is not required for business operations.

Public Exploit Available: false

Organizations using the Unicamp theme must ensure that they are running the latest version to close this security gap. Given that this vulnerability can be exploited by authenticated subscribers, minimizing user privileges and monitoring for unauthorized database access are essential steps to mitigate risk.