The CVSS 8.5 on this CVE is the first signal something unusual is happening. A subscriber-level SQL injection should land in the 7-8 range with meaningful uncertainty. An 8.5 tells you the analysts saw clear, high-impact exploitation paths — and in this case, those paths run through the w3all plugin's core function: synchronizing authentication between WordPress and phpBB.
The critical detail the CVE description omits: this isn't just a SQL injection in a WordPress plugin. It's a SQL injection in a session-bridging layer that maps authenticated WordPress users onto phpBB's permission model. When a subscriber triggers this injection, they're not just accessing WordPress data — they're potentially harvesting credentials that re-authenticate across both systems. The plugin's architecture explicitly trusts the authenticated context from WordPress and treats it as pre-validated for phpBB operations. That's where the injection lives: in the translation logic between two permission models that were never designed to share trust boundaries.
The practical risk is credential propagation, not just data exfiltration. A successful exploit can yield session tokens or password hashes that work in both the WordPress and phpBB environments. You're not patching one system — you're auditing an architectural failure that treats 'authenticated elsewhere' as 'authenticated here.'
Prioritize remediation by treating this as an authentication boundary failure, not a discrete SQLi. Isolate the session synchronization layer if possible; if the plugin lacks architectural separation between trust verification and permission translation, plan for a full code review of every role-mapping code path. Given that phpBB itself is largely legacy software with diminishing security attention, the integration target likely hasn't been scrutinized in years — which means this may be one of several vulnerabilities in the same architecture. Monitor for adjacent disclosures in w3all and similar phpBB bridge plugins within the next 12-18 months. Organizations should treat this as a high-priority architectural review, not a routine plugin update.