A critical SQL injection vulnerability in the Rest Routes WordPress plugin allows unauthenticated attackers to exfiltrate sensitive database information.

This is a SQL injection vulnerability (CWE-89) triggered by the failure to sanitize and validate values taken from public REST route URLs. Unauthenticated attackers can exploit this flaw to execute arbitrary SQL queries against the underlying database.

The vulnerability carries a CVSS score of 8.6, reflecting the high risk posed by unauthenticated access to database contents. Successful exploitation could lead to unauthorized data exfiltration, exposure of sensitive user credentials, or compromise of the entire WordPress installation.

Immediate Action: Since a specific patch is not currently identified, administrators should immediately deactivate or remove the Rest Routes plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous query patterns, specifically those containing SQL syntax or unusual characters within REST API request paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting REST API endpoints.

Public Exploit Available: Unknown

Given the high CVSS score and the exposure of the database to unauthenticated actors, this vulnerability presents a significant risk to organizational data integrity. We strongly recommend immediate deactivation of the affected plugin until a verified vendor patch is applied to neutralize the SQL injection vector.