A high-severity SQL injection vulnerability in the Kadence Shop Kit plugin allows authenticated subscribers to potentially extract sensitive database information.

The plugin fails to properly neutralize special elements in SQL commands, resulting in a classic SQL injection (CWE-89). This flaw is exploitable by any authenticated subscriber, meaning an attacker with low-level user privileges can trigger the vulnerability.

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially bypass access controls to read sensitive information stored within the WordPress database, leading to unauthorized data exposure. Given the CVSS score of 8.5, this vulnerability represents a high risk that requires immediate attention to prevent potential data breaches or unauthorized administrative actions.

Immediate Action: Update the Kadence Shop Kit plugin to version 3.0.6.1 or the latest available version provided by the vendor.

Proactive Monitoring: Review database access logs for anomalous query patterns or unexpected SQL syntax that may indicate automated exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter malicious SQL injection payloads targeting the WordPress plugin environment.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

This vulnerability presents a high risk due to the potential for unauthorized database access by authenticated users. Administrators should prioritize the update to version 3.0.6.1 immediately to close the injection vector. Regular auditing of user roles and plugin permissions is recommended to further limit the impact of similar vulnerabilities.