The WP jQuery Pager plugin contains a vulnerability that allows an authenticated user with Contributor level or higher to inject arbitrary SQL via the 'ids' attribute in the shortcode handler. This flaw stems from insufficient escaping of the user supplied parameter and the lack of prepared statements, enabling attackers to append additional queries to the existing statement. Such an injection can result in the extraction of sensitive database information, exposing user credentials, site content, or other confidential data. The official CVSS score of 6.5 indicates a moderate severity with significant potential impact on confidentiality and integrity.

All WordPress sites that have installed Ivycat’s WP jQuery Pager plugin version 1.4.0 or earlier are vulnerable. The plugin is available through the WordPress plugin repository, and any site running these versions should be examined.

The risk of exploitation is characterized by a moderate CVSS rating of 6.5 and a very low EPSS probability of less than 1%, meaning the vulnerability is unlikely to be widely exploited at present. However, the flaw is not included in CISA’s KEV catalog, which suggests no known active exploitation. Attackers would need authenticated Contributor-level access and would typically perform the injection by inserting a malicious shortcode in a post or page. Successful exploitation leads to arbitrary SQL execution and data exfiltration, with full database compromise as the potential worst‑case outcome.