The vulnerability resides in Joomla vWishlist 1.0.1, where an attacker who has gained authentication can supply malicious SQL fragments in the vproductid and userid POST parameters. This allows the attacker to execute arbitrary SELECT or other statements against the database, retrieving sensitive information such as database version, names, and potentially other tables. The weakness is a classic SQL injection flaw (CWE‑89).

The affected product is Wdmtech’s vWishlist component for Joomla, version 1.0.1. No other Joomla extensions were listed. Users running this component without updating are vulnerable.

The CVSS score of 7.1 indicates a high‑to‑moderate risk. Exploitation requires the attacker to be authenticated to the Joomla installation, so impersonation or credential theft is a prerequisite. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. In practice, once authenticated, an attacker can read confidential database contents, which could lead to data exposure or further compromise.