CVE-2023-1730: 
WordPress vulnerability analysis and mitigation

The SupportCandy WordPress plugin versions before 3.1.5 contains an SQL injection vulnerability (CVE-2023-1730). The vulnerability stems from the plugin's failure to properly validate and escape user input before using it in SQL statements, affecting websites running the vulnerable versions of the plugin (WPScan, NVD).

The vulnerability is classified as an SQL injection (SQLI) vulnerability with a CVSS score of 8.6 (High). It falls under the OWASP Top 10 category A1: Injection and is identified as CWE-89. The vulnerability allows unauthenticated attackers to perform SQL injection attacks through malformed input (WPScan).

This vulnerability allows unauthenticated attackers to perform SQL injection attacks against affected WordPress installations. Given its unauthenticated nature and high CVSS score, successful exploitation could lead to unauthorized access to or manipulation of the website's database (WPScan).

The vulnerability has been patched in SupportCandy version 3.1.5. Website administrators running affected versions should update to version 3.1.5 or later immediately to mitigate this security risk (WPScan).