An SQL injection vulnerability in the VeronaLabs WP SMS plugin poses a high risk of unauthorized database exposure for affected WordPress environments.

This flaw is a CWE-89 SQL injection vulnerability where the application fails to properly sanitize input before incorporating it into database queries. The CVSS vector indicates that this requires high privileges (PR:H), meaning an authenticated administrator is required to trigger the exploit.

The ability to perform SQL injection allows an attacker to bypass standard database queries to access sensitive information stored within the WordPress database. Given the CVSS score of 7.6, this vulnerability represents a significant risk to data confidentiality and integrity, potentially leading to the theft of user credentials, personal data, or configuration settings.

Immediate Action: Review the official Patchstack vendor advisory for the release of a patched version of WP SMS and update the plugin immediately upon availability.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that suggest automated SQL injection attempts against the WordPress backend.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns directed at the plugin endpoints.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The identified SQL injection vulnerability necessitates prompt attention to ensure the security of the WordPress database. Administrators should prioritize updating the WP SMS plugin as soon as a fix is released and ensure that administrative access to the WordPress dashboard is strictly limited to authorized personnel to mitigate the risk of exploitation.