A critical unauthenticated SQL injection vulnerability in the WCFM Marketplace plugin poses a high risk of database compromise to affected WordPress sites.

This is an improper neutralization of special elements used in an SQL command (CWE-89), which allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying database.

The ability for an unauthenticated attacker to perform SQL injection poses a severe threat to data confidentiality. Successful exploitation could lead to the unauthorized exposure of sensitive site data, including user credentials, order information, or administrative metadata, potentially resulting in full site compromise and significant reputational damage. The CVSS score of 9.3 reflects the critical nature of this flaw, as it requires no authentication and allows for remote data extraction.

Immediate Action: Update the WCFM Marketplace plugin to version 3.8.2 or the latest available version immediately.

Proactive Monitoring: Review web server and database logs for suspicious query patterns, such as unexpected SQL syntax or high volumes of requests to marketplace endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity of 9.3 and the unauthenticated nature of the attack vector, this vulnerability must be treated as a high-priority remediation task. Administrators should verify their plugin version and apply the patch to 3.8.2 or higher as soon as possible to prevent potential data breaches.