WordPress Paid Downloads Plugin SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in the WordPress Paid Downloads plugin, specifically in versions through 3.15. This vulnerability allows attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification.

Impact

Exploitation of this vulnerability could allow attackers to interact with the database of the affected WordPress site, with the possibility of stealing or manipulating information.

Remediation

Users are advised to update to a version of the WordPress Paid Downloads plugin that is later than 3.15. For those using Patchstack, a mitigation rule has been issued to block attacks until an official fix can be applied.