A critical SQL injection vulnerability in the ELEX WooCommerce Request a Quote plugin allows unauthenticated attackers to exfiltrate database contents.

This flaw is a SQL injection (CWE-89) arising from a failure to properly sanitize and escape input parameters before processing them in database queries. The vulnerability is exploitable by unauthenticated users via the network.

Successful exploitation allows unauthorized actors to bypass authentication and execute arbitrary SQL commands, potentially leading to the full exposure of sensitive customer or administrative data stored within the WordPress database. Given the CVSS score of 8.6, this vulnerability represents a high risk to data confidentiality and integrity, necessitating immediate remediation to prevent potential data breaches.

Immediate Action: Update the ELEX WooCommerce Request a Quote plugin to version 2.4.1 or later immediately.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected database activity originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while updates are being staged.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to the security of your WordPress environment due to the ease of access for unauthenticated attackers. It is strongly recommended that administrators prioritize updating the ELEX WooCommerce Request a Quote plugin to version 2.4.1 across all affected production instances to eliminate this attack vector.