A critical SQL injection vulnerability in the ProLancer Element plugin allows authenticated subscribers to execute malicious database queries, risking unauthorized data exposure.

This is a SQL injection vulnerability (CWE-89) occurring within the plugin. The vulnerability is exploitable by an authenticated user with subscriber-level access, allowing them to manipulate database queries.

By exploiting this flaw, an attacker could extract information from the WordPress database, which may include sensitive user data, configuration details, or other critical information. With a CVSS score of 8.5, this vulnerability is considered High, as it allows for significant unauthorized data access despite the requirement for a low-privilege subscriber account.

Immediate Action: Update the ProLancer Element plugin to the latest available version as soon as a patch is released by ThemeBing.

Proactive Monitoring: Monitor database query logs for suspicious activity originating from subscriber-level accounts, such as unexpected SELECT or UNION statements.

Compensating Controls: If a patch is not immediately available, consider disabling the plugin or restricting subscriber access to the functionality provided by the plugin until a fix can be applied.

Public Exploit Available: No

Given the ease with which subscriber accounts can be created on many WordPress sites, this vulnerability presents an elevated risk. Administrators should audit the plugin’s usage and ensure that the software is updated immediately upon the availability of a security patch to prevent potential database compromise.