An authenticated SQL injection vulnerability in the WordPress Persistent Login plugin, version 3.1.0 and below, poses a significant risk of unauthorized database access.

The plugin fails to properly sanitize user input, allowing authenticated subscribers to perform SQL injection attacks. This vulnerability requires a low-privilege user account to exploit.

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration or administrative account compromise. Given the CVSS score of 8.5, this represents a high-severity risk that could compromise the integrity and confidentiality of the entire WordPress installation.

Immediate Action: Update the WordPress Persistent Login plugin to version 3.1.1 or later immediately.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that may indicate injection attempts by authenticated users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests targeting the plugin's vulnerable parameters.

Public Exploit Available: No

Organizations utilizing this plugin must prioritize the update to version 3.1.1. Given the potential for full database compromise, failure to remediate this vulnerability leaves the application susceptible to severe data breaches.