The URL Shortener Plugin for WordPress is vulnerable to SQL injection via the analytic_id parameter in all versions up to 3.0.7. The insufficient escaping and lack of prepared statements allow unauthenticated attackers to append arbitrary SQL to the existing query, enabling extraction of sensitive data from the database. This flaw is a classic CWE-89 injection vulnerability that compromises the confidentiality of stored information.

The vulnerability affects the WordPress URL Shortener Plugin for WordPress developed by rupok98. Any installation of the plugin with a version number 3.0.7 or earlier is impacted. Users of WordPress sites that have not yet migrated to a newer version of the plugin are at risk.

The CVSS score is 9.8, denoting a critical severity level, while the EPSS score is below 1%, indicating a low probability of exploitation yet still requiring prompt action. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely and without authentication by sending crafted HTTP requests containing an analytic_id value that injects malicious SQL. Once exploited, the attacker could read or manipulate database contents.