The WP Links Page plugin contains a flaw where the “id” parameter is not sufficiently escaped and the plugin does not use prepared statements. An authenticated user with Subscriber level or higher can send arbitrary SQL code that is appended to an existing SELECT query. By manipulating the parameter, the attacker can extract confidential database content, exposing sensitive site information and compromising confidentiality.

The vulnerability affects the WordPress plugin WP Links Page from vendor rico-macchi, in all releases up to and including 4.9.6. Any WordPress installation that has not applied a later version is potentially exploitable. No other versions or products are listed as affected.

The CVSS score of 6.5 classifies the issue as medium severity, while the EPSS score of less than 1% indicates a low likelihood of real-world exploitation. The flaw is not registered in the CISA KEV catalog. Exploitation requires a valid authenticated account with Subscriber rights or higher and no further software or conditions are needed. Once access is gained, the attacker can use the injection to read database tables.