A critical Blind SQL Injection vulnerability in the WP Attractive Donations System plugin allows unauthenticated remote attackers to compromise database integrity.

This is a Blind SQL Injection vulnerability (CWE-89) that fails to properly neutralize special characters in SQL commands. The flaw is accessible to unauthenticated remote attackers, allowing them to interfere with the application's database operations.

Successful exploitation allows an attacker to extract sensitive information or alter database content, potentially leading to a full compromise of the WordPress site's data. Although the CVSS score is 9.3, the absence of a vendor-provided patch necessitates immediate defensive action to prevent data theft or unauthorized administrative access.

Immediate Action: Since no official patch is available, immediately deactivate or uninstall the WP Attractive Donations System plugin until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns or anomalous SQL syntax that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeted at WordPress plugins.

Public Exploit Available: Unknown

Because there is no currently available patch, the only effective way to mitigate this risk is to discontinue the use of the affected plugin. Administrators should monitor vendor channels for updates and only re-enable the plugin if a verified, secure version is released.