SQL Injection in WordPress Loginizer plugin before 1.6.4

A successful attacker can manipulate SQL queries executed by the vulnerable plugin, which can lead to unauthorized access to or modification of application data. Based on the provided description, exploitation may also result in cross-site scripting, potentially enabling execution of attacker-controlled script in a victim's browser within the WordPress context. Depending on deployment and database permissions, this could affect the integrity and confidentiality of site data and facilitate further compromise of administrative sessions or site content.

If immediate patching is not possible, disable the Loginizer plugin or restrict access to the affected WordPress instance until the update can be applied. Reduce exposure by limiting access to WordPress administrative interfaces, deploying a WAF with rules to detect and block SQL injection payloads, and monitoring failed-login related requests and database activity for suspicious input patterns. Because resultant XSS is noted, administrators should also review rendered content and administrative workflows for unexpected script execution.

Upgrade the Loginizer WordPress plugin to version 1.6.4 or later, which addresses this vulnerability. Review the plugin's changelog and vendor guidance to confirm the fixed version is deployed across all affected WordPress instances. After patching, inspect logs and site content for signs of exploitation, including anomalous failed-login related records and possible injected script content.