The Visualizer plugin for WordPress permits injection of arbitrary SQL through the 'query' parameter due to lacking escaping and failure to prepare existing statements. An authenticated user with Contributor-level access or higher can exploit this flaw to append extra SQL clauses and read sensitive database information. The attack leverages directly user input, bypassing normal query sanitation, which can lead to disclosure of private data.

WordPress sites running the Visualizer: Tables and Charts Manager plugin version 3.11.12 or older are affected. The vulnerability remains in 3.11.13 unless the user role is elevated to administrator; it is fully addressed in 3.11.14. The plugin is maintained by ThemeIsle.

The CVSS score of 6.5 rates this flaw as moderate, and the EPSS score of less than 1% indicates low probability of widespread exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires legitimate user access and a web-based interaction that submits data to the vulnerable endpoint. Once exploited, the attacker can retrieve confidential database content. The associated CWE-89 reflects a classic injection weakness.