A critical SQL injection vulnerability in the VillaTheme WPBulky plugin allows authenticated contributors to perform unauthorized database operations, posing a significant risk to site data integrity.

The plugin fails to properly sanitize user inputs before passing them to SQL queries, which is categorized as CWE-89. This vulnerability requires the attacker to have at least Contributor-level privileges to successfully trigger the injection.

The vulnerability carries a CVSS score of 8.5, reflecting a high severity due to its potential for unauthorized data exfiltration or sensitive information disclosure. Successful exploitation could lead to total compromise of the database contents, resulting in severe reputational damage, loss of intellectual property, and potential non-compliance with data privacy regulations.

Immediate Action: Update the WPBulky plugin to the latest version, specifically 1.2.3 or higher, where this vulnerability has been addressed.

Proactive Monitoring: Review database query logs for unusual patterns or unexpected syntax, particularly those originating from user accounts with Contributor or lower permissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the update can be applied.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the direct impact on database security, administrators must prioritize updating the WPBulky plugin immediately. If an update is not immediately feasible, restrict the permissions of user accounts or temporarily deactivate the plugin to prevent potential exploitation of the backend database.