The Robcore Netatmo WordPress plugin contains a flaw that allows an authenticated user with Contributor privileges or higher to inject arbitrary SQL code through the module_id attribute of the robcore-netatmo shortcode. By supplying crafted input, the attacker can append additional SQL statements to the existing query, enabling the extraction of sensitive information from the WordPress database.

All installations of the Robcore Netatmo plugin with versions 1.7 and earlier are impacted. The vulnerability resides in the code that processes the robcore-netatmo shortcode, specifically the handling of the module_id parameter.

The CVSS score of 6.5 reflects a moderate severity impact. Because the exploit requires a WordPress account with Contributor-level or higher permissions, the potential attacker pool is limited to users with sufficient site privileges. The EPSS score of <1% indicates a low probability of exploitation across the general ecosystem, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread attacks have been reported. An attacker would need to supply malicious input within the shortcode, which could be detected through monitoring of database queries or by applying defensive filtering.