The WP EasyCart plugin for WordPress contains a high-severity SQL injection vulnerability that allows authenticated users with contributor privileges to potentially extract sensitive database information.

This vulnerability is a SQL injection (CWE-89) arising from improper neutralization of special elements used in SQL commands. It requires an attacker to have at least contributor-level authentication to trigger the flaw through the plugin's vulnerable database interaction points.

The exploitation of this vulnerability could lead to significant data compromise, as an attacker can manipulate database queries to access unauthorized information. Given the CVSS score of 8.5, the risk is high, particularly if the database contains sensitive customer records or administrative credentials. Failure to remediate this flaw may result in a breach of data privacy regulations and loss of customer trust.

Immediate Action: Update the WP EasyCart plugin to version 6.0.0 or the latest available version provided by Level Four Development.

Proactive Monitoring: Review database query logs for anomalous patterns or unauthorized access attempts originating from contributor-level user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the WordPress environment.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

This SQL injection vulnerability presents a serious risk to data confidentiality and should be addressed as a priority. Security teams must ensure that all instances of the WP EasyCart plugin are updated to version 6.0.0 immediately to eliminate this attack vector. Organizations should also audit their WordPress user roles to ensure that only authorized individuals hold contributor or higher privileges.