A critical SQL injection vulnerability in the Amelia plugin enables unauthenticated attackers to compromise database integrity and confidentiality.

This is a Blind SQL Injection vulnerability (CWE-89) arising from the improper neutralization of special elements in SQL commands. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector (PR:N).

Successful exploitation allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exfiltration or administrative bypass. Given the CVSS score of 9.3, this represents a critical risk to business continuity and data privacy, as it permits full read access to sensitive customer or system information stored within the WordPress database.

Immediate Action: Update the Amelia plugin to the latest available version beyond 2.4.2 to incorporate the vendor's security fixes.

Proactive Monitoring: Review database query logs for unusual patterns, such as unexpected use of UNION SELECT or boolean-based inference attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeting the WordPress environment.

Public Exploit Available: No

The critical nature of this SQL injection vulnerability necessitates immediate action. Administrators must prioritize updating the Amelia plugin to a patched version to prevent potential database compromise. If an immediate update is not feasible, restrict access to the affected site or disable the plugin until a secure version is deployed.