The Dynamically Display Posts plugin for WordPress contains a critical SQL injection flaw in the 'tax_query' parameter. Malicious actors can craft input that is not properly escaped or bound, allowing them to append additional SQL statements to existing queries. This vulnerability enables unauthenticated attackers to retrieve sensitive data from the WordPress database, potentially exposing content, user credentials, or other confidential information. The weakness is a classic injection flaw quantified as CWE-89.

WordPress sites that have installed the Dynamically Display Posts plugin in any release version 1.1 or earlier. The attack surface covers all public requests that trigger the plugin’s front‑end logic, as the flaw is present in the database access code used by unauthenticated users.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an external actor to send a crafted request containing the vulnerable 'tax_query' parameter to a publicly accessible WordPress endpoint that loads the plugin. No prior authentication is required, and the impact is primarily data exfiltration rather than code execution.