Custom Searchable Data Entry System WordPress Plugin Unauthenticated Database Wiping Vulnerability

A vulnerability exists in the Custom Searchable Data Entry System plugin for WordPress, in versions through 1.7.1. The issue allows unauthenticated users to wipe database tables, including wp_users, due to a missing capability check and inadequate validation in the ghazale_sds_delete_entries_table_row() function.

Impact

Exploitation of this vulnerability allows for unauthenticated users to delete entries from database tables, potentially including critical tables like wp_users.

Remediation

The plugin has been removed from the WordPress repository and is no longer available for download. Users are advised to deactivate and delete the plugin from their WordPress installation.