Wp Partner
Monthly
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.