An unauthenticated SQL injection vulnerability in the Album Cover Finder WordPress plugin poses a high risk of unauthorized data exposure.

The plugin fails to sanitize and escape input parameters before incorporating them into SQL queries. This allows an unauthenticated attacker to manipulate database queries, potentially leading to unauthorized data exfiltration.

Successful exploitation of this flaw allows an attacker to interact directly with the underlying database without requiring valid credentials. This results in a significant risk of data breach, including the potential exposure of sensitive user information or site configuration data. With a CVSS score of 8.6, this vulnerability is categorized as high severity and requires immediate attention to protect organizational assets.

Immediate Action: Since no official patch is currently available, administrators should immediately deactivate and remove the Album Cover Finder plugin from all WordPress installations.

Proactive Monitoring: Security teams should monitor database query logs for unusual patterns, such as unexpected syntax or large volumes of data retrieval requests originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to reduce the attack surface until the plugin is removed or updated.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of SQL injection, the risk to the confidentiality of the WordPress database is substantial. Organizations utilizing this plugin must prioritize its removal immediately, as no vendor patch is currently available to resolve the underlying security defect.