A critical SQL injection vulnerability in the Business Directory Plugin for WordPress allows unauthenticated attackers to exfiltrate sensitive data from the database.

The plugin fails to properly sanitize the payment parameter, resulting in a time-based SQL injection vulnerability. This flaw allows unauthenticated attackers to append malicious SQL queries to existing database commands.

This vulnerability poses a significant risk to data confidentiality, as it permits unauthorized access to sensitive information stored within the WordPress database. Given the CVSS score of 7.5, the potential for automated exploitation by remote, unauthenticated actors makes this a high-priority security issue. Successful exploitation could lead to the exposure of user credentials, directory data, or other proprietary information, resulting in severe reputational and operational damage.

Immediate Action: Update the Business Directory Plugin to version 6.4.22 or the latest available version provided by the vendor to patch the SQL injection vulnerability.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or patterns indicative of blind SQL injection attempts targeting the payment parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious SQL injection payloads targeting the payment endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

The presence of a public proof-of-concept alongside the unauthenticated nature of this flaw necessitates immediate attention. Administrators must verify their plugin version and apply the vendor-supplied update without delay. Failure to remediate this vulnerability leaves the underlying WordPress database exposed to potential information disclosure attacks.