A critical SQL injection vulnerability in the Link Library WordPress plugin allows unauthenticated attackers to compromise sensitive database information.

This vulnerability is a SQL injection (CWE-89) flaw originating from a failure to sanitize or escape user-supplied input before processing it in a SQL query. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive user data, database corruption, or complete compromise of the WordPress site, justifying its critical CVSS score of 9.1.

Immediate Action: Update the Link Library WordPress plugin to version 7.9.3 or later immediately to apply the vendor-supplied patch.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or high volumes of requests to the link-library plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: Unknown.

The high severity of this vulnerability, combined with the lack of authentication requirements, necessitates immediate action. Administrators must prioritize updating the Link Library plugin to version 7.9.3 across all instances to prevent potential data exfiltration or unauthorized database manipulation.