A critical SQL injection vulnerability in the WPNakama plugin for WordPress allows unauthenticated attackers to extract sensitive database information.

The plugin fails to properly sanitize the order parameter within the /wp-json/WPNakama/v1/boards REST API endpoint. This lack of input validation and parameterized queries allows an unauthenticated attacker to inject malicious SQL commands to manipulate database queries.

Successful exploitation of this vulnerability permits unauthorized access to sensitive data stored within the WordPress database. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality, potentially leading to the exposure of user credentials, private project details, or configuration data.

Immediate Action: Update the WPNakama plugin to the latest available version that includes the patch for this SQL injection flaw. If an update is not immediately available, disable or remove the plugin from the WordPress environment.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the /wp-json/WPNakama/v1/boards endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious requests targeting the vulnerable REST API parameter.

Public Exploit Available: No (Exploit status is unknown).

The severity of this vulnerability necessitates immediate attention from administrators managing sites with the WPNakama plugin installed. Given the potential for unauthenticated data exfiltration, organizations should prioritize updating the plugin or removing it if it is not essential to business operations to eliminate the attack surface entirely.