The Legoeso PDF Manager plugin for WordPress contains a time‑based SQL injection flaw in the checkedVals parameter in all versions up to 1.2.2. Because the input is not properly escaped and the SQL query is built without sufficient preparation, an attacker who has Author‑level or higher permissions can append arbitrary SQL statements to the original query. This allows extraction of sensitive information from the database, such as user credentials, site content, and other confidential data controlled by the WordPress installation.

WordPress sites that have the Legoeso PDF Manager plugin installed at version 1.2.2 or earlier. Any user with Author or higher privileges on the site can exploit the flaw. The vendor announced the fix in later releases, so administrators should verify their plugin version against the affected range.

The CVSS base score of 6.5 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog and it requires authenticated access to the WordPress admin interface. Attackers would need to be able to log in with an Author‑level account and then craft a request targeting the checkedVals parameter, which is typically part of the plugin’s internal administration pages. Because the attacker must already have sufficient privileges, the overall risk is limited but still non‑negligible, especially for sites with large numbers of Authors or where the database contains highly sensitive content.