The eShipper Commerce plugin for WordPress contains an authenticated SQL injection vulnerability that poses a high risk of database compromise.

This vulnerability is a SQL injection (CWE-89) arising from improper neutralization of user-supplied input. It requires the attacker to have at least low-level authenticated access to the WordPress site to trigger the malicious SQL commands.

Successful exploitation of this vulnerability allows an authenticated attacker to perform unauthorized database queries, potentially leading to the extraction of sensitive information or modification of site data. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to data confidentiality and integrity, necessitating immediate attention.

Immediate Action: Check the WordPress plugin repository for an update beyond version 2.16.13 and apply it immediately. If no update is available, deactivate and remove the plugin until a vendor-supplied patch is confirmed.

Proactive Monitoring: Monitor database query logs for anomalous or high-frequency requests originating from low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Public Exploit Available: Unknown

The high CVSS score reflects the serious potential for unauthorized database access. Administrators should prioritize identifying all instances of the eShipper Commerce plugin and ensure they are patched to a secure version to prevent potential data exfiltration.