A Blind SQL Injection vulnerability in the WP Inventory Manager plugin for WordPress permits authenticated attackers to perform unauthorized database actions.

This is a Blind SQL Injection (CWE-89) vulnerability that allows authenticated users with low privileges to manipulate SQL queries. The flaw lies in the handling of user-supplied data, which lacks proper neutralization before being processed by the database.

With a CVSS score of 8.5, this vulnerability represents a high risk to the confidentiality of the WordPress database. Unauthorized access to the database could result in the exposure of customer inventory data, user records, or other sensitive business intelligence stored within the application.

Immediate Action: No patch is currently available; users are advised to deactivate the plugin until the vendor releases a security update.

Proactive Monitoring: Enable detailed database query logging and monitor for unusual query structures that could indicate an attempt to perform SQL injection.

Compensating Controls: Configure a Web Application Firewall (WAF) to inspect and block inputs containing SQL keywords or special characters commonly used in injection attacks.

Public Exploit Available: No

Immediate deactivation of the WP Inventory Manager plugin is strongly recommended until a vendor-supplied patch is available. Organizations should maintain a strict patch management policy and verify that the plugin is updated immediately upon the release of version 2.4.1 or higher.