An unauthenticated SQL injection vulnerability in the Throws SPAM Away plugin poses a critical risk of unauthorized database data exfiltration.

The plugin fails to properly sanitize user-supplied input before using it in SQL commands, which allows an unauthenticated attacker to inject malicious SQL queries. This flaw exists due to improper neutralization of special elements within SQL commands, as defined by CWE-89.

The ability for an unauthenticated attacker to perform SQL injection poses a severe threat to data confidentiality. A successful exploit could lead to the unauthorized disclosure of sensitive information stored in the WordPress database, potentially including user credentials, configuration data, or private site content. Given the high CVSS score of 9.3, this vulnerability represents a critical risk that warrants immediate attention to prevent significant data loss and potential regulatory non-compliance.

Immediate Action: Update the Throws SPAM Away plugin to version 3.9 or the latest available version released by the vendor to remediate the vulnerability.

Proactive Monitoring: Review web server and database access logs for suspicious patterns, such as unexpected SQL syntax characters or unusual query structures originating from external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads to provide a temporary layer of protection while the update is being staged.

Public Exploit Available: No

This vulnerability is critical due to the lack of required authentication, which lowers the barrier to entry for potential attackers. Organizations utilizing the Throws SPAM Away plugin must prioritize updating to version 3.9 immediately. Failure to patch this flaw leaves the underlying database exposed to direct manipulation and unauthorized data access.