The RapidResult plugin for WordPress versions up to 1.2 contains a CWE‑89 SQL Injection flaw. An authenticated user with contributor or higher permissions can issue a request with a crafted "s" parameter that is unsafely concatenated into an existing SQL query. This permits the injection and execution of arbitrary SQL statements, enabling the attacker to read sensitive information such as user accounts, passwords, or configuration data from the database.

All installations of the RapidResult plugin provided by onlinediagnosticbd that run version 1.2 or earlier are affected. The vulnerability exists regardless of the underlying WordPress core version because the flaw resides entirely within the plugin code.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score of less than 1 percent suggests a low likelihood of exploitation in the current threat landscape, and the issue is not listed in the CISA KEV catalog. Nevertheless, the required privilege level is contributor‑level, a role commonly assigned on many sites, which raises the potential impact if exploited. The attack vector is inferred to be a web‑based request containing a malicious "s" parameter sent to the plugin’s endpoint.