The GSpeech TTS – WordPress Text To Speech Plugin contains a parameter, 'field', that is not properly escaped when incorporated into an SQL statement. As a result, authenticated users with Administrator or higher privileges can inject additional SQL commands, enabling the extraction of sensitive data from the WordPress database. This vulnerability is a classic instance of CWE‑89, where improper input validation leads to injection of arbitrary SQL queries.

All versions of the GSpeech TTS – WordPress Text To Speech Plugin up to and including 3.17.13, supplied by creative‑solutions-1, are affected. The flaw is only exploitable by users who have Administrator level access through the WordPress dashboard.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploit attempts are currently rare. The vulnerability is not listed in CISA KEV, but the requirement for an authenticated admin account means that a successful attack requires compromised credentials or a brute‑force gain of admin rights. In organizations where user accounts are tightly controlled and strong authentication mechanisms are in place, the immediate risk is lower, but any exposure of an admin account presents a significant threat of data exfiltration.