A high-severity SQL injection vulnerability in WP EasyCart allows authenticated contributors to compromise the integrity and confidentiality of the underlying database.

The vulnerability is a SQL Injection flaw occurring within the WP EasyCart plugin. It requires the attacker to hold at least a 'Contributor' level authentication to successfully execute malicious SQL queries against the database.

The exploitation of this vulnerability could lead to unauthorized data exfiltration, modification of e-commerce records, or administrative account takeover. With a CVSS score of 8.5, this high-severity flaw poses a significant risk to business continuity and data privacy, potentially resulting in severe reputational damage and regulatory non-compliance.

Immediate Action: Identify and update the WP EasyCart plugin to the latest secure version provided by the vendor.

Proactive Monitoring: Enable database query logging and monitor for unusual SQL patterns or syntax errors that deviate from standard application behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) with specific SQL injection protection rules to filter malicious input requests.

Public Exploit Available: false

Given the potential for full database compromise, organizations must prioritize patching this plugin immediately. Security teams should audit user roles to ensure that the 'Contributor' capability is restricted to trusted personnel until the patch is successfully deployed.