A critical SQL injection vulnerability in the BuddyBoss Platform plugin allows unauthenticated attackers to execute malicious database queries, potentially leading to full site database compromise.

This is an SQL injection vulnerability (CWE-89) where the plugin fails to properly neutralize user-supplied input, allowing an unauthenticated attacker to interact directly with the underlying database.

The CVSS score of 9.3 highlights the severe risk posed by this vulnerability. Successful exploitation allows for the exfiltration of sensitive site data, including user credentials or private community information, and may provide a vector for further unauthorized system access.

Immediate Action: Update the BuddyBoss Platform plugin to version 3.1.0 or later immediately.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected UNION SELECT statements or syntax errors originating from the plugin.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection enabled to filter and drop malicious queries targeting the plugin.

Public Exploit Available: Unknown

This vulnerability presents a major risk to the confidentiality of your platform data. You must apply the update to version 3.1.0 as soon as possible to neutralize the injection vector and secure your database.