A critical unauthenticated SQL injection vulnerability in the VikRentItems Flexible Rental Management System plugin for WordPress allows remote attackers to extract sensitive database information.

The plugin fails to correctly sanitize and escape input parameters before processing them in SQL queries, enabling unauthenticated remote attackers to execute arbitrary SQL commands against the WordPress database.

Successful exploitation allows unauthorized access to the application database, potentially resulting in the compromise of sensitive customer data, configuration details, or internal application credentials. Given the CVSS score of 8.6, this flaw poses a high risk to data confidentiality and application integrity, warranting immediate remediation to prevent potential data breaches.

Immediate Action: Update the VikRentItems Flexible Rental Management System plugin to version 1.2.4 or later immediately.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected SQL syntax that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: No

The high CVSS score of 8.6 underscores the severity of this unauthenticated SQL injection vulnerability. Administrators are advised to prioritize updating the affected plugin to version 1.2.4 immediately. If an update cannot be performed, the plugin should be disabled or removed to eliminate the attack surface until a secure configuration is established.