The gVectors wpDiscuz plugin for WordPress is vulnerable to unauthenticated SQL injection, posing a severe risk of unauthorized database access and data exfiltration.

The vulnerability exists within the getAllSubscriptions function, where multiple parameters including email and activation_key are not properly escaped before being processed in SQL queries. This allows an unauthenticated remote attacker to execute arbitrary SQL commands against the WordPress database.

Successful exploitation of this flaw allows an attacker to bypass security controls to access, modify, or delete sensitive information stored in the WordPress database. Given the CVSS score of 8.1, this is classified as a High severity vulnerability that could lead to full compromise of the application data, potentially resulting in significant reputational damage and loss of user privacy.

Immediate Action: Update the wpDiscuz plugin to version 7.6.47 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review database error logs for unusual query syntax or unauthorized access attempts directed at the plugin subscription endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the update can be applied.

Public Exploit Available: False

This vulnerability represents a significant risk to the integrity and confidentiality of the WordPress environment. Administrators must prioritize the update of the wpDiscuz plugin to version 7.6.47 to ensure the vulnerability is remediated, as SQL injection remains a primary vector for total application compromise.