The ClickWhale WordPress plugin is vulnerable to SQL injection through the export_csv() function because user input is not properly escaped and the query is not prepared. This flaw, classified as CWE‑89, would allow an attacker to append additional SQL statements to the existing query, resulting in extraction of sensitive database information. The vulnerability is exploitable only by authenticated users who have at least Administrator privileges, though it could be leveraged by lower‑level users if the plugin is granted to them.

The affected product is ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages, a WordPress plugin. Versions up to and including 2.5.0 contain the flaw; versions released after 2.5.0 are not listed as affected.

The CVSS score of 4.9 indicates moderate severity, but the EPSS score of <1% reflects a very low likelihood that this weakness will be exploited in the wild. The vulnerability is not currently in CISA’s KEV catalog, suggesting that no widespread exploitation is known. Nevertheless, the flaw permits attackers with sufficient authentication to read privileged data, so risk rises if an admin account is compromised or if non‑administrator users are granted plugin access. The attack vector is authenticated access, requiring active logins to the WordPress backend and the use of the export function, which makes public‑remote exploitation impossible.