The CMS Commander plugin for WordPress contains an SQL injection vulnerability that allows authenticated attackers with API access to compromise sensitive database information.

The vulnerability exists in the restore workflow due to insufficient escaping of user-supplied parameters and improper preparation of SQL queries. This allows an attacker with CMS Commander API key access to inject malicious SQL commands into existing queries.

Successful exploitation allows an attacker to extract sensitive data from the underlying WordPress database, potentially leading to a full compromise of site credentials or configuration. With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and integrity of the affected environment.

Immediate Action: Since a specific patched version is currently unconfirmed, administrators should disable the CMS Commander plugin until an official security update is released by the vendor.

Proactive Monitoring: Monitor database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts against the identified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns directed at WordPress plugin endpoints.

Public Exploit Available: No confirmed public exploit is available.

Given the high severity of this SQL injection vulnerability, organizations using the CMS Commander plugin must prioritize the restriction of API access and monitor for any signs of unauthorized database activity. Administrators should keep a close watch on the vendor advisory for the release of a security patch and apply it immediately once it becomes available to remediate the flaw.