The vulnerability exists in the Quick Featured Images WordPress plugin, where the delete_orphaned function fails to properly escape user‑supplied data, allowing an authenticated user with Editor level or higher access to inject arbitrary SQL statements. This can result in sensitive information being extracted from the database or other unintended database modifications. The impact is data exposure rather than remote code execution.

Kybernetik Services’ Quick Featured Images plugin, all releases up to and including version 13.7.3. No other vendors or product versions are listed as affected.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The plugin is not listed in the CISA KEV catalog. Exploitability requires an attacker to be logged in with at least Editor privileges and to convince a higher‑privileged user to insert a malicious custom field value, after which the attacker can append SQL statements. The requirement for social engineering lowers the likelihood, but the potential to read or manipulate database contents remains a concern for sites with sensitive data.