A critical SQL injection vulnerability in the Sergey AIWU WordPress plugin enables unauthenticated attackers to compromise database confidentiality.

This vulnerability is a Blind SQL Injection (CWE-89) that occurs because the plugin does not properly sanitize user-supplied input before executing SQL commands. The vulnerability is network-exploitable without requiring authentication (AV:N/PR:N).

Successful exploitation of this vulnerability could allow an attacker to read data from the database, potentially exposing user credentials, configuration secrets, or other sensitive application data. The CVSS score of 9.3 underscores the extreme risk to the application's backend security and the potential for large-scale data theft.

Immediate Action: Update the AIWU plugin to the latest version immediately. If an update is unavailable, deactivate the plugin until the vendor provides a remediation.

Proactive Monitoring: Review web server and database error logs for signs of SQL injection attempts, including common SQL syntax characters (e.g., ', --, UNION) in unexpected input fields.

Compensating Controls: Implement a WAF to filter malicious traffic and block requests containing common SQL injection signatures directed at the AIWU plugin.

Public Exploit Available: Unknown

The severity of this issue necessitates an immediate response. Administrators must ensure all instances of the AIWU plugin are updated to the latest version to eliminate the SQL injection vector and protect against potential unauthorized data access.