An unauthenticated SQL injection vulnerability in the Quentn WP WordPress plugin allows remote attackers to compromise sensitive database information.

This vulnerability is a SQL injection (CWE-89) flaw caused by the failure to properly escape request parameters before including them in SQL queries. An unauthenticated attacker can exploit this via network-accessible vectors to retrieve sensitive data from the underlying database.

The ability for an unauthenticated attacker to extract arbitrary database content poses a severe risk to data confidentiality. Given the CVSS score of 8.6, this vulnerability is classified as high severity, potentially leading to the exposure of customer personal information, authentication credentials, or proprietary business data. Such a breach could result in significant regulatory penalties, loss of customer trust, and long-term reputational damage.

Immediate Action: Update the Quentn WP plugin to version 1.2.15 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review web server and database logs for suspicious query patterns, particularly those containing SQL syntax or unusual parameter character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to provide temporary protection until the patch is applied.

Public Exploit Available: No

The high severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Quentn WP plugin to version 1.2.15 to eliminate the risk of unauthorized data extraction. Failure to patch this flaw leaves the database exposed to remote, unauthenticated exploitation.