The "Specific Content For Mobile – Customize the mobile version without redirections" WordPress plugin is susceptible to a SQL Injection flaw caused by improper escaping and lack of query preparation in the eos_scfm_duplicate_post_as_draft() function. The vulnerability allows users with Contributor or higher roles to append malicious SQL statements to existing queries, enabling extraction of sensitive database information. This is a classic input validation weakness identified as CWE‑89.

All installations of the "Specific Content For Mobile – Customize the mobile version without redirections" plugin with version 0.5.5 or earlier are affected. The plugin is distributed by the vendor giuse and integrates into WordPress sites.

The CVSS score for this issue is 6.5. The EPSS indicates a very low but non‑zero likelihood of exploitation, currently less than 1%. It is not listed in CISA’s KEV catalog. Attackers need authenticated access with at least Contributor privileges, so the attack vector is internal; an adversary who gains legitimate contributor access can use the injection to read database contents.