The WPRecovery WordPress plugin is vulnerable to an unauthenticated SQL injection through the data[id] parameter in all releases up to version 2.0. An attacker can append malicious SQL fragments to the query, allowing extraction of sensitive database content. The result of that injection is then passed directly to PHP’s unlink() function, which permits the attacker to delete arbitrary files on the server. The combination of data exfiltration and file deletion represents a significant loss of confidentiality and integrity.

All installations of the quantumrose WPRecovery plugin, version 2.0 and earlier, are affected. Those deploying older releases of the plugin for WordPress fall under the scope of this vulnerability.

The CVSS base score of 9.1 highlights the severity, while the EPSS score of < 1% indicates that exploitation probability remains low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated HTTP request containing crafted data[id] input; no prior authentication or privileged access is necessary. The attack surface is thus wide, making the risk primarily driven by the high impact rather than widespread exploitation.