The PGS Core plugin for WordPress is vulnerable to an unauthenticated SQL Injection through the 'event' parameter used in the 'save_header_builder' function. The flaw stems from insufficient escaping of user supplied input and the absence of parameterized queries, categorized as CWE-89. Attackers can insert additional SQL statements into the existing query, enabling them to retrieve sensitive database data without any authentication.

The vulnerability affects PGS Core by Potenza Global Solutions, all releases up to and including version 5.8.0. No other versions or vendors are currently listed as affected.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the flaw is not currently catalogued in the CISA KEV list. Based on the description, the attack vector is a remote, unauthenticated request to the plugin’s 'save_header_builder' endpoint where the 'event' parameter can be manipulated to inject SQL.