An unauthenticated SQL injection vulnerability in the Ajax Load More WordPress plugin allows attackers to extract sensitive data, necessitating an immediate update to version 8.0.1.

The plugin fails to properly sanitize and escape parameters used in SQL queries (CWE-89). This flaw permits unauthenticated attackers to conduct time-based blind SQL injection attacks against the underlying database.

This vulnerability is critical, with a CVSS score of 9.1, as it allows unauthenticated access to the database. Successful exploitation could result in the unauthorized disclosure of sensitive user data, administrative credentials, or full database compromise, posing significant reputational and operational risks.

Immediate Action: Update the Ajax Load More plugin to version 8.0.1 or later immediately.

Proactive Monitoring: Security teams should review database query logs for unusual time-based patterns or syntax errors that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the plugin update can be applied.

Public Exploit Available: No (no confirmed public exploit available).

The critical severity of this vulnerability, combined with the lack of required authentication for an attacker, necessitates immediate remediation. Administrators must verify that the plugin is updated to version 8.0.1 across all WordPress instances to prevent unauthorized database access.