The Attention Bar WordPress plugin does not sanitize and escape a user supplied parameter before it is used in a SQL statement. This omission allows administrators, who have high level privileges on the site, to inject arbitrary SQL code. As a result, an attacker with admin access can read, modify or delete data stored in the WordPress database, potentially compromising the confidentiality, integrity and availability of the site.

WordPress installations that use the Attention Bar plugin version 0.7.2.1 or earlier are affected. The plugin is distributed under the Unknown:attention-bar vendor ID, so any site that has installed or upgraded to the affected version is at risk.

The CVSS score of 6.8 classifies this vulnerability as moderate severity, and the EPSS score of less than 1 percent suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated administrators to exploit the flaw, so the attack vector is limited to privileged users of the site. However, once executed, the injected SQL commands can give the attacker full control over the plugin’s database data.