Boost WordPress Plugin SQL Injection Vulnerability

A time-based SQL injection vulnerability has been identified in the Boost plugin for WordPress, affecting versions through 2.0.3. The issue arises from inadequate escaping of user-supplied parameters in the 'current_url' and 'user_name' fields, coupled with a lack of proper preparation in the existing SQL queries. This vulnerability allows unauthenticated attackers to inject additional SQL commands into existing queries, potentially leading to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can manipulate SQL queries to extract data from the database, potentially including sensitive information.

Remediation

Users are advised to update the Boost WordPress plugin to version 2.0.4 or a newer patched version.