A critical SQL injection vulnerability in the Project Management, Bug and Issue Tracking WordPress plugin allows unauthenticated remote attackers to compromise sensitive database information.

This flaw exists due to improper sanitization and escaping of user-supplied input within the plugin's front-end issue tracker configuration. Because the vulnerability resides in the input handling logic, it allows unauthenticated attackers to inject malicious SQL commands directly into the database.

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive user data, administrative credentials, or full application database compromise. Given the CVSS score of 9.1, this vulnerability should be prioritized as a critical threat to the availability and security of the hosting environment.

Immediate Action: Update the Project Management, Bug and Issue Tracking Plugin to version 5.1.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review database query logs for anomalous patterns, such as unexpected UNION SELECT statements or error-based injection attempts, which may indicate active exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter malicious SQL syntax from incoming HTTP requests until the patch can be fully deployed across the environment.

Public Exploit Available: Unknown

Due to the critical severity and the lack of authentication required to trigger this flaw, immediate patching is mandatory for all affected WordPress installations. Administrators must verify that the plugin has been updated to version 5.1.0 and should audit existing user accounts for any unauthorized modifications that may have occurred prior to the update.