The Outdoor plugin for WordPress contains an unauthenticated SQL injection vulnerability in the ‘edit’ action. User input is appended to an existing SQL query without sufficient escaping or preparation, allowing attackers to inject arbitrary statements that can read or modify database contents. The consequence is the disclosure of any data accessible through the database, such as user credentials, posts, or site configuration, compromising confidentiality and potentially integrity.

All installations of the Outdoor plugin by maycorolbuche1 that are at version 1.3.2 or earlier are affected. This includes WordPress sites that have not applied any later release of the plugin.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is unlikely in the near term, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated and exists in a widely used plugin, an attacker can target a site by simply issuing a crafted request to the edit action without needing any credentials. The attack path requires only HTTP access to the vulnerable endpoint; no privileged access, local files, or user interaction is necessary beyond normal web access.