A critical unauthenticated SQL injection vulnerability has been identified in the WordPress plugin 'Throws SPAM Away' affecting versions 3.8.2 and earlier. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially exposing sensitive database information or enabling further compromise of the WordPress site. The flaw is documented under CVE-2026-81763 and has been reported via both the NVD and Patchstack vulnerability databases. No authentication is required to exploit this vulnerability, making it particularly dangerous for unpatched installations. WordPress site administrators using this plugin are advised to update to a patched version immediately. The vulnerability was assigned a high severity rating. Details are available through the NVD and Patchstack advisory pages.
