A high-severity SQL injection vulnerability in the WP w3all phpBB plugin could allow an authenticated attacker to compromise database confidentiality.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). It requires the attacker to hold at least subscriber-level privileges to successfully execute the injection.

The vulnerability poses a significant risk to data confidentiality, as successful exploitation allows unauthorized actors to perform arbitrary database queries. Given the CVSS score of 8.5, this flaw could lead to the exposure of sensitive user information or plugin configuration data, potentially resulting in a broader breach of the WordPress environment.

Immediate Action: Update the WP w3all phpBB plugin to version 3.0.6 or later immediately.

Proactive Monitoring: Review database access logs for anomalous, high-frequency, or malformed queries originating from subscriber-level accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Public Exploit Available: No (exploit_available: false)

The high CVSS score of 8.5 reflects the potential for serious data compromise. Administrators should verify their current plugin version and apply the 3.0.6 update as soon as possible to mitigate the risk of unauthorized database access.