A critical unauthenticated SQL injection vulnerability in the Verified Reviews plugin allows remote attackers to compromise backend database information.

The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling an unauthenticated attacker to execute arbitrary SQL commands. This flaw occurs within the plugin's interaction layer, allowing for unauthorized database access.

With a CVSS score of 9.3, this vulnerability presents a severe risk to the confidentiality of stored data, including user reviews, customer information, or plugin configuration settings. Attackers can leverage this injection to extract sensitive database contents or potentially escalate privileges depending on the database user permissions. The ability to perform this attack without authentication makes it highly attractive for automated scanning and exploitation.

Immediate Action: Disable or remove the Verified Reviews plugin until a security patch is provided by the vendor, as no fixed version is currently identified.

Proactive Monitoring: Monitor database query logs for unusual activity, such as unexpected UNION SELECT statements or unauthorized table access attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common SQL injection patterns and block requests targeting the plugin's known vulnerable endpoints.

Public Exploit Available: Unknown

Given the lack of a verified patch, the most secure course of action is to deactivate the plugin immediately to prevent potential data exfiltration. Security teams should maintain vigilance by monitoring database logs and ensuring that the plugin remains disabled until the vendor releases a secure version that addresses the underlying SQL injection flaw.