The vulnerability exists in the 2.2 release of the KittyCatfish plugin for WordPress. An attacker can send a specially crafted GET request carrying a value in the kc_ad parameter to either base.css.php or kittycatfish.php. Because the value is not properly escaped, the plugin concatenates it directly into a SQL statement, enabling a classic SQL injection. This flaw allows an unauthenticated user to read arbitrary database tables through boolean‑based blind or time‑based blind techniques. The weakness falls under the injection category defined by CWE‑89.

All WordPress sites that have installed KittyCatfish 2.2 are affected. The plugin is distributed by Missilesilo and is listed as a WordPress plugin on the official repository. Unless a newer, patched version is deployed, any instance using this version remains vulnerable.

The flaw carries a CVSS score of 8.8, indicating a high severity. EPSS is not available, but the absence of a public KEV entry suggests there are no confirmed exploits in the wild at the time of this analysis. An unauthenticated attacker can exploit the weakness by sending a crafted HTTP GET request containing the kc_ad parameter. Through this vector the attacker can extract sensitive database contents, potentially compromising confidentiality of user data and site configuration.