A critical SQL injection vulnerability in the Library Management System WordPress plugin allows unauthenticated attackers to potentially exfiltrate sensitive database information.

This is a SQL injection vulnerability (CWE-89) arising from improper input sanitization. The flaw is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector (PR:N).

The vulnerability carries a CVSS score of 8.6, reflecting its high severity due to the potential for unauthorized data access. Successful exploitation could lead to full exposure of sensitive database content, including user credentials or private organizational information, resulting in significant data breach risk and regulatory non-compliance.

Immediate Action: Update the Library Management System plugin to version 3.5.8 or later immediately.

Proactive Monitoring: Monitor database query logs for anomalous or malformed SQL patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting WordPress plugins.

Public Exploit Available: No

Given the high CVSS score and the presence of proof-of-concept material, this vulnerability poses a significant risk to the confidentiality of your WordPress environment. Administrators must prioritize updating the affected plugin to version 3.5.8 immediately to eliminate the risk of database compromise.