A critical SQL Injection vulnerability has been identified in the WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin. This vulnerability could allow a malicious actor to directly interact with the affected database, including but not limited to stealing information.

This vulnerability was discovered and responsibly reported by Lana Codes.

The vulnerability is an SQL Injection vulnerability that occurs in the ipanorama-360.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious SQL code into the database.

Severity:

The vulnerability has a CVSS 3.1 score of 8.8, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

All versions of the iPanorama 360 WordPress Virtual Tour Builder Plugin prior to 1.8.1 are affected by this vulnerability.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Steal sensitive information from your database, such as user passwords, credit card numbers, and other sensitive data.
  • Modify or delete data in your database.
  • Disable your website or database.
  • Take complete control of your website and database.

Recommendation:

The urgency of this situation necessitates rapid and decisive action to secure the website:

  1. Update the Plugin: Without delay, update the iPanorama 360 Virtual Tour Builder Plugin to at least version 1.8.1. This update is essential to mitigate the security risks associated with the SQL Injection vulnerability.
  2. Regularly Update Plugins: Beyond this immediate update, establish a practice of regularly updating all WordPress plugins and themes to their latest versions. Keeping website components up to date is a fundamental security measure.
  3. Enhance Security Measures: Consider the implementation of additional security measures such as web application firewalls (WAFs), robust authentication protocols, and frequent security audits. A comprehensive security strategy is crucial to minimize potential exploitation attempts.