The WP ERP Pro WordPress plugin is vulnerable to unauthenticated SQL injection, which could allow remote attackers to extract sensitive database information.

The plugin contains an SQL Injection vulnerability (CWE-89) in the 'search_key' parameter. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially exposing database contents.

This vulnerability carries a CVSS score of 7.5, indicating a high risk of data breach. An attacker could leverage this flaw to dump sensitive user data, administrative credentials, or proprietary business information stored within the WordPress database.

Immediate Action: As no patch is currently available, administrators should immediately deactivate or remove the WP ERP Pro plugin until a secure version is released by the vendor.

Proactive Monitoring: Review database query logs for suspicious patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting the 'search_key' parameter.

Public Exploit Available: Unknown

Given the lack of a vendor-provided fix and the high risk associated with unauthenticated SQL injection, immediate removal of the vulnerable plugin is the only effective mitigation to ensure database security.