The vulnerability is an SQL injection that allows an attacker to retrieve arbitrary information from the database by sending a malicious value in the 'idsignup' POST parameter to the admin‑ajax.php endpoint. This flaw falls under the Input Validation weakness CWE‑89 and can be exploited by unauthenticated users.

Affected systems are WordPress sites that have installed the Wow Viral Signups 2.1 plugin. The plugin's unescaped 'idsignup' parameter in admin‑ajax.php is the attack surface; all installations of version 2.1 are impacted. If newer plugin versions exist, they may mitigate the flaw, but their availability is not stated.

The CVSS v3.1 score of 8.8 indicates a high severity, while no EPSS data is provided. The vulnerability is not listed in CISA KEV. Attackers can exploit it by sending crafted HTTP POST requests to the admin‑ajax.php endpoint, bypassing authentication and executing arbitrary SQL. Because the flaw does not require elevated privileges, the risk is widespread and could expose sensitive data such as user credentials or content. Deployment of effective mitigations is therefore critical.