The vulnerability is a classic SQL Injection flaw (CWE‑89) that arises when the plugin concatenates the user supplied 'id' parameter directly into a database query without proper escaping or preparation. An attacker who has authenticated Contributor or higher privileges can supply malicious input in the 'id' field and have additional SQL statements executed by the server. This allows the attacker to read any data the authenticated user can read, potentially exposing sensitive information such as user passwords, email addresses, or other private content stored in the WordPress database.

WordPress sites that install the WP Dashboard Chat plugin by nicholasbosch version 1.0.3 or earlier are affected. Sites running any earlier release are also vulnerable because the code change that fixed the issue was introduced in 1.0.4.

The severity of the flaw is reflected in a CVSS score of 6.5, which denotes moderate impact. The EPSS score is listed as < 1%, indicating that, as of the last assessment, the probability of exploitation is very low. The issue is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor or higher privileges, and the attack vector is likely via the plugin’s interface where the 'id' parameter is accepted. The attacker can submit a crafted request through the normal WordPress authentication flow, making the attack feasible but still dependent on privileged access.