The Dinatur WordPress plugin is susceptible to unauthenticated SQL injection and data destruction, posing a critical risk to site integrity.

The plugin fails to sanitize user input in SQL queries and lacks authorization checks for database table truncation, allowing unauthenticated attackers to execute malicious queries and wipe plugin data.

The CVSS score of 8.6 reflects the high severity of this vulnerability, as it allows unauthenticated attackers to perform destructive actions against the database. Successful exploitation could result in total data loss for the plugin or unauthorized access to sensitive information stored within the WordPress database.

Immediate Action: Since a patch is not currently available, administrators should deactivate and remove the Dinatur plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual activity or signs of SQL injection patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the site.

Public Exploit Available: Yes, a public Proof-of-Concept exists.

Given the lack of a patch and the existence of public exploit code, the only effective way to mitigate this risk is to discontinue the use of the plugin. Organizations should monitor vendor channels for a security update before considering re-enabling the software.