The VR‑Frases plugin for WordPress suffers from SQL Injection in several parameters because user input is not properly escaped and existing queries are not prepared. The flaw allows an attacker to append arbitrary SQL statements to the constructed query, enabling them to retrieve any data stored in the MySQL database attached to the WordPress site. This can expose sensitive information such as user credentials, post metadata, and other confidential content, thereby compromising the confidentiality and integrity of the entire installation.

The vulnerability affects all releases of vruizg:VR‑Frases up to and including version 3.0.1. Any WordPress website running one of these plugin versions is susceptible unless a newer, patched release is deployed.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low but non‑zero probability of exploitation at the time of analysis. The flaw is listed as a classic SQL Injection (CWE‑89) and is not currently in CISA’s KEV catalog. Based on the description, the attack can be carried out by submitting malicious data through the plugin’s input endpoints without needing prior authentication, thereby allowing unauthenticated users to cause data extraction attacks. The exploit path requires sending a crafted HTTP request that includes the vulnerable parameter, which the plugin processes and concatenates into an SQL query without sanitization.