The Nelio AB Testing plugin for WordPress is vulnerable to a blind SQL injection flaw that could allow a high-privileged attacker to extract sensitive information from the underlying database.

This vulnerability is a blind SQL injection (CWE-89) stemming from improper neutralization of special elements in SQL commands. The CVSS vector (PR:H) indicates that an attacker must possess administrative privileges to successfully trigger the vulnerability.

Successful exploitation of this vulnerability permits an attacker to perform blind SQL injection attacks, potentially leading to the unauthorized disclosure of sensitive data stored within the WordPress database. Given the CVSS score of 7.6, this flaw poses a significant risk to data confidentiality and integrity, particularly for environments relying on the plugin to manage sensitive marketing or customer analytics data.

Immediate Action: Since a specific patch version is not currently identified, administrators should monitor the Nelio Software vendor advisory page for updates and apply them as soon as they become available. If no update is available, consider deactivating the plugin until a secure version is released.

Proactive Monitoring: Security teams should review database query logs for suspicious patterns, such as unexpected use of boolean-based or time-based blind SQL injection payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false).

Organizations utilizing the Nelio AB Testing plugin should treat this vulnerability with high priority due to the inherent risks associated with SQL injection. Administrators must remain vigilant for vendor security bulletins and prioritize the installation of any forthcoming security updates to ensure the environment remains protected against unauthorized database access.