The NooTheme Organici Library plugin is vulnerable to blind SQL injection, which could allow an authenticated attacker to compromise sensitive database information.

This is a blind SQL injection vulnerability (CWE-89) triggered by improper input neutralization in the library. Per the CVSS vector (PR:L), this attack requires a low-privileged authenticated user to initiate.

The vulnerability poses a high risk to business operations by enabling unauthorized data exfiltration from the underlying database. With a CVSS score of 8.5, this high-severity flaw could lead to the exposure of sensitive user data or system configurations, potentially resulting in significant reputational damage and compliance violations.

Immediate Action: Since no specific patch version is confirmed, administrators should immediately deactivate or remove the affected Organici Library plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review database query logs for unusual patterns, such as unexpected syntax errors or suspicious SQL keywords originating from user-controlled parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while the plugin remains inactive.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of SQL injection, security teams should treat this vulnerability with high urgency. Administrators must restrict the use of the plugin within their environment and monitor for any signs of database compromise until the vendor releases a patched version.