An authenticated SQL injection vulnerability in the eRoom plugin exposes site databases to unauthorized query execution by contributors.

This is a SQL injection vulnerability, classified as CWE-89, stemming from the failure to properly sanitize user-supplied input before using it in database queries. The vulnerability is exploitable by an attacker with contributor level permissions.

The ability to perform SQL injection allows an attacker to interact directly with the backend database, risking the theft of sensitive information or the modification of application data. The high CVSS score of 8.5 reflects the potential for severe impact on the confidentiality of the affected WordPress site.

Immediate Action: Monitor for updates from DigitalME and apply the security patch as soon as it is released to resolve the underlying code flaw.

Proactive Monitoring: Audit database logs for suspicious query patterns, specifically focusing on actions taken by accounts with contributor privileges.

Compensating Controls: Utilize a Web Application Firewall to inspect incoming traffic and block requests containing common SQL injection payloads.

Public Exploit Available: Unknown.

The severity of this issue necessitates timely intervention. Security teams should prioritize patching the eRoom plugin as soon as a fix is available and ensure that user roles are assigned according to the principle of least privilege.