The myLinksDump plugin for WordPress contains an SQL injection vulnerability that allows authenticated attackers with administrative privileges to compromise database integrity and confidentiality.

The plugin fails to properly sanitize user-supplied input in the sort_by and sort_order parameters, leading to an SQL injection vulnerability (CWE-89). This flaw permits authenticated attackers with administrator-level access to manipulate SQL queries and potentially exfiltrate sensitive data from the underlying database.

This vulnerability poses a significant risk to organizational data security, as successful exploitation could lead to unauthorized access to sensitive information stored within the WordPress database. Given the CVSS score of 7.2, this is categorized as a high-severity issue because it grants attackers the ability to bypass standard data access controls, potentially resulting in full database compromise or unauthorized administrative actions.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the myLinksDump plugin from all WordPress installations until a vendor-supplied fix is verified.

Proactive Monitoring: Security teams should monitor database query logs for unusual syntax or unexpected patterns originating from administrative accounts that might indicate attempts to leverage SQL injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns, which may provide temporary protection while the plugin remains inactive or pending a security update.

Public Exploit Available: No confirmed public exploit (weaponized or otherwise) is currently available in the provided data.

Due to the high severity of this SQL injection vulnerability, it is imperative that organizations treat this as a priority. Because the plugin allows for the extraction of sensitive database content by administrative accounts, the most effective mitigation is the immediate removal of the vulnerable software. Continue to monitor the vendor and the WordPress plugin repository for official security updates that address this flaw.