The PixelYourSite Boost plugin for WordPress is susceptible to an unauthenticated time-based SQL injection vulnerability that could lead to unauthorized database information disclosure.

This is a time-based SQL injection vulnerability (CWE-89) triggered by improper sanitization of the 'current_url' and 'user_name' parameters. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N/UI:N.

Successful exploitation allows an attacker to perform blind SQL injection, potentially leading to the exfiltration of sensitive data from the WordPress database. While the CVSS score is 7.5 (High), the ability for unauthenticated actors to remotely query the database poses a significant risk to data confidentiality and regulatory compliance.

Immediate Action: Update the PixelYourSite Boost plugin to version 2.0.4 or later immediately.

Proactive Monitoring: Monitor database query logs for anomalous, high-latency queries or patterns indicative of SQL injection attempts, such as unexpected use of SLEEP() or BENCHMARK() functions.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress URL parameters.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for unauthorized data access, administrators should prioritize updating the Boost plugin to version 2.0.4. If an immediate update is not feasible, consider deactivating the plugin until a patch can be applied to eliminate the risk of remote information disclosure.