A critical SQL injection vulnerability in the WP Data Access plugin for WordPress allows unauthenticated attackers to potentially extract sensitive database information.

This vulnerability is a classic SQL injection (CWE-89) arising from the improper neutralization of special elements in SQL commands. It allows an unauthenticated remote attacker to interact directly with the underlying database.

The ability to perform unauthenticated SQL injection poses a severe risk to data confidentiality and integrity. With a CVSS score of 9.3, this flaw enables unauthorized access to potentially sensitive application data, which could lead to a full compromise of the WordPress site database, regulatory non-compliance, and significant reputational damage.

Immediate Action: Update the WP Data Access plugin to version 5.5.82 or the latest available version immediately.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, such as unexpected syntax characters or large data extraction attempts, originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to provide temporary protection while the update is being staged.

Public Exploit Available: Unknown

Given the critical CVSS severity score of 9.3 and the lack of required authentication for exploitation, this vulnerability represents an immediate and high-priority threat. Administrators must prioritize the application of the vendor-supplied patch to version 5.5.82. Failure to update allows for trivial remote exploitation and must be addressed to maintain the security posture of the WordPress environment.