A critical SQL injection vulnerability in the Product Question and Answer WordPress plugin allows unauthenticated attackers to exfiltrate sensitive data from the database.

The plugin fails to sanitize and escape input parameters before utilizing them in database queries within AJAX endpoints. Because these endpoints are accessible to unauthenticated users, any remote attacker can execute arbitrary SQL commands.

This vulnerability carries a CVSS score of 8.6, reflecting its high severity and ease of exploitation. Successful exploitation grants attackers direct access to the backend database, potentially leading to the theft of customer records, administrative credentials, or proprietary site configuration data, which poses a significant risk of data breach and reputational damage.

Immediate Action: Since a specific patch version is not currently identified, users should immediately deactivate and remove the Product Question and Answer plugin from their WordPress installations until a vendor-supplied update is verified.

Proactive Monitoring: Review database audit logs for unusual query patterns, such as unexpected UNION SELECT statements or excessive error responses from AJAX endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust SQL injection filtering rules to intercept and block malicious payloads targeting the plugin's vulnerable AJAX parameters.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the high CVSS score and the lack of authentication required to trigger the vulnerability, this issue presents an urgent risk to site integrity. Security teams should prioritize the removal of the affected component until the developer releases a secure version, as SQL injection remains a primary vector for large-scale data exfiltration.