An authenticated SQL injection vulnerability in the Create by Mediavine plugin exposes site databases to unauthorized query execution by contributors.

This vulnerability is a SQL injection flaw, categorized as CWE-89, that occurs due to improper neutralization of special elements in SQL commands. The attack requires the attacker to have at least contributor level authentication to the WordPress site.

Successful exploitation of this vulnerability could allow an attacker to read sensitive information from the underlying database, such as user credentials, configuration data, or private site content. With a CVSS score of 8.5, this high severity issue poses a significant risk to data confidentiality and integrity, potentially leading to unauthorized data exposure or complete site compromise.

Immediate Action: Administrators should monitor the vendor's security advisories for a patched version release and update the plugin immediately upon availability.

Proactive Monitoring: Review database query logs for unusual or unauthorized SQL syntax, particularly those originating from user accounts with contributor privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection patterns to help mitigate the risk while awaiting a permanent patch.

Public Exploit Available: Unknown.

Given the high CVSS score, this vulnerability represents a significant risk to site security. Administrators should restrict contributor access if possible and ensure that the plugin is updated to the latest version immediately once a fix is provided by the vendor.