An unauthenticated SQL injection vulnerability in the bpost-shipping-platform plugin exposes sensitive database information to remote attackers.

The plugin fails to sanitize input parameters used in SQL queries during the order submission process. This allows an unauthenticated attacker to inject malicious SQL commands and perform time-based blind queries to exfiltrate data.

This vulnerability carries a CVSS score of 7.5, reflecting a high risk of data breach. An attacker could potentially gain access to customer information, order details, or payment metadata, leading to significant reputational damage and regulatory non-compliance.

Immediate Action: Update the bpost-shipping-platform plugin to version 3.2.3 or later immediately.

Proactive Monitoring: Monitor database query performance and logs for anomalous patterns indicative of blind SQL injection attempts, such as unusually long response times.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input strings and block suspicious SQL injection patterns targeting the checkout process.

Public Exploit Available: Yes (a public proof-of-concept exists).

The presence of a public proof-of-concept elevates the risk of exploitation. Organizations using this plugin must apply the 3.2.3 update without delay to prevent unauthorized database access.