A critical SQL injection vulnerability in the Quentn WP WordPress plugin allows unauthenticated attackers to extract sensitive database information.

This vulnerability is an SQL injection flaw (CWE-89) located in the get_user_access() method. Due to insufficient escaping of user supplied data in the qntn_wp_access cookie, unauthenticated attackers can append malicious SQL queries to existing database commands.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality. Successful exploitation could lead to the unauthorized extraction of sensitive user data, configuration details, or other information stored within the WordPress database. Given the CVSS score of 7.5, this vulnerability represents a high risk to organizational data integrity and privacy.

Immediate Action: Since no official patch is currently identified, administrators should immediately deactivate and remove the Quentn WP plugin from all WordPress installations until a secure version is released.

Proactive Monitoring: Security teams should monitor database query logs for unusual patterns or syntax errors indicative of SQL injection attempts, specifically targeting cookie-based inputs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious input directed at the qntn_wp_access cookie.

Public Exploit Available: Unknown

Due to the severity of this unauthenticated SQL injection vulnerability, immediate action is required to reduce the attack surface. Organizations currently utilizing the Quentn WP plugin should prioritize its removal from their production environments. Continue to monitor official vendor channels for the release of a patched version before considering re-installation.