The Rich Snippet Site Report plugin for WordPress contains an SQL injection flaw caused by insufficient escaping of the 'last' parameter and the lack of preparation on the underlying query. This vulnerability allows an attacker to inject arbitrary SQL, enabling the extraction or manipulation of sensitive database information. The issue is directly tied to CWE-89, representing improper input handling for SQL statements.

WordPress sites running the Rich Snippet Site Report plugin in any version up to and including 2.0.0105 are vulnerable. Versions beyond 2.0.0105 are not known to contain this flaw, but the patch only applies to installations using the affected range.

The CVSS score of 4.9 indicates a moderate severity, while the EPSS score of fewer than 1% suggests exploitation is unlikely in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, further reflecting its lower threat prominence. Attackers can exploit the flaw by sending crafted requests containing the 'last' parameter, which can be delivered via standard plugin interactions or through a CSRF vector, making it accessible to unauthenticated or low-privilege users.