A critical SQL injection vulnerability in the KlbTheme Total Donations WordPress plugin allows unauthenticated attackers to compromise sensitive database contents.

The plugin fails to properly sanitize user supplied parameters before incorporating them into SQL queries. This allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability permits unauthorized access to sensitive information stored within the WordPress database. Given the CVSS score of 9.8, this flaw presents a critical risk that could lead to full database compromise, including administrative credentials and customer data, resulting in significant reputational and operational damage.

Immediate Action: Update the KlbTheme Total Donations plugin to the latest version immediately to ensure all SQL queries are properly parameterized.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax, such as unexpected UNION or SELECT statements, that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: Unknown.

This vulnerability represents a severe threat to data integrity and confidentiality. Administrators must prioritize updating the plugin to the latest available version to mitigate the risk of unauthorized data extraction, as this entry point provides a direct path for attackers to bypass application security.