DirectIQ Email Marketing WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the DirectIQ Email Marketing WordPress plugin, affecting versions through 2.0. This vulnerability allows attackers to improperly manipulate SQL commands, potentially leading to unauthorized database access or data manipulation.

Impact

Exploitation of this vulnerability allows for direct interaction with the database, which could include stealing information or manipulating database contents.

Remediation

Users are advised to remove and replace the DirectIQ Email Marketing WordPress plugin, as it is likely abandoned and will not receive further updates or fixes. Deactivating the plugin does not eliminate the security threat unless a virtual patch is applied. Patchstack offers a virtual patch to mitigate this vulnerability by blocking attacks until an official fix is available.