The External Login plugin for WordPress contains an insecure handling of the 'log' parameter, allowing unauthenticated attackers to inject SQL through existing queries. A compromised request can remain in a POST or GET payload and bypass the plugin’s protective checks, producing additional SQL that runs on the authorisation database. When a PostgreSQL or MSSQL database is used for external authentication, the injected payload can read sensitive credentials or other confidential data from that database, representing a significant confidentiality breach.

WordPress sites running the External Login plugin version 1.11.2 or earlier. The vulnerability only applies when the plugin is configured to use a PostgreSQL or Microsoft SQL Server database for external authentication.

The CVSS score of 7.5 indicates a high severity of the flaw, but the EPSS score of less than 1% suggests that the likelihood of a public exploit is currently low. The vulnerability is not listed in the CISA KEV catalog, so there is no catalogued active exploitation. Nonetheless, the flaw can be triggered by an unauthenticated HTTP request that includes a specially crafted 'log' parameter, so the attack vector is via the web interface. An attacker who can reach the vulnerable endpoint can potentially extract data from the external authentication database without needing any credentials or administrative access to the WordPress site.