The Find Me On WordPress plugin, versions up to 2.0.9.1, contains a flaw that fails to sanitize and escape a user‑supplied parameter before it is incorporated into a SQL statement. This omission allows any authenticated user with the Subscriber role or higher to inject arbitrary SQL into backend queries. The vulnerability is a classic example of CWE‑89 (SQL Injection) and could enable the attacker to read, modify, or delete data in the WordPress database, potentially compromising user data and site integrity.

Any WordPress site that has the Find Me On plugin installed and is running a version ≤ 2.0.9.1 is impacted. The plugin is distributed under an unknown vendor, so all installations using this plugin version are at risk. The flaw is only exploitable by accounts that already exist on the site, so ordinary visitors who cannot authenticate are not directly affected unless additional misconfigurations allow anonymous access to the relevant endpoints.

With a CVSS score of 7.7, the flaw is considered high severity. The EPSS metrics show a probability of exploitation of less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. Nevertheless, because the attack requires only subscriber‑level access—roles commonly assigned to regular users—the potential for exploitation is significant. Administrators should treat this as a high‑priority issue and act promptly to mitigate the risk.