A critical SQL injection vulnerability in the Quotes llama WordPress plugin allows unauthenticated attackers to exfiltrate sensitive data from the database.

This is a SQL injection vulnerability (CWE-89) occurring because the plugin fails to sanitize user-supplied parameters before incorporating them into SQL queries. The vulnerability allows unauthenticated attackers to perform UNION-based queries to extract information from the database.

The CVSS score of 8.6 reflects the high severity of this vulnerability, as it allows for the remote extraction of critical data such as password hashes. This could lead to full site compromise, unauthorized administrative access, and significant data breaches if not remediated promptly.

Immediate Action: Update the Quotes llama plugin to version 3.1.6 or the latest available version immediately.

Proactive Monitoring: Audit database logs for suspicious queries that utilize UNION operators or patterns indicative of data exfiltration.

Compensating Controls: Utilize a WordPress-specific security plugin or a WAF to filter malicious SQL injection attempts directed at the site.

Public Exploit Available: No confirmed public exploit (weaponized) is available.

This vulnerability represents a significant risk to WordPress site owners. Given the availability of a proof-of-concept and the high CVSS score, updating the plugin to the patched version is a mandatory security task to prevent potential database compromise.