Critical · published October 1, 2025
🚨 An unauthenticated attack can wipe your WordPress database with just one request! Imagine someone strolling into a restaurant and erasing every order from the system — that’s the kind of damage this vulnerability allows. 🔥 Think of the Custom Searchable Data Entry System plugin like a restaurant’s order management system. If a server accepts any order without verifying the identity of the person making the request, someone could swoop in and erase all the customer data, leaving the restaurant in chaos! This vulnerability means a malicious actor could obliterate crucial database tables—like wp_users—without needing any authentication. This could lead to total data loss and cause absolute devastation for your site, leaving it unusable and your users frustrated.
Think of the Custom Searchable Data Entry System plugin like a restaurant’s order management system. If a server accepts any order without verifying the identity of the person making the request, someone could swoop in and erase all the customer data, leaving the restaurant in chaos! The vulnerability exists due to a missing capability check and insufficient validation in the ghazale_sds_delete_entries_table_row() function, allowing unauthorized users to execute destructive database commands.
This vulnerability means a malicious actor could obliterate crucial database tables—like wp_users—without needing any authentication. This could lead to total data loss and cause absolute devastation for your site, leaving it unusable and your users frustrated. Immediately update the Custom Searchable Data Entry System plugin to version 1.7.2 or later to mitigate this critical vulnerability. Additionally, review your user permissions and database security practices to prevent unauthorized access. 🔒 You've got this! By taking these steps, you're securing your site like a pro. 🛡️