A flaw in the WordPress My Auctions Allegro plugin allows attackers without authentication to inject malicious SQL through the auction_id parameter. The vulnerability stems from inadequate input escaping and the lack of prepared statements, enabling attacker-supplied strings to be concatenated into an existing database query. Successful exploitation offers the ability to read sensitive data such as user credentials, transaction histories, or other confidential information stored in the WordPress database, thereby compromising the confidentiality of the site.

All releases of the My Auctions Allegro WordPress plugin from vendor Wphocus up to and including version 3.6.32 are affected. The plugin is routinely used in e‑commerce WordPress sites hosting auction listings.

The scoring model assigns a CVSS score of 7.5, indicating high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires only unauthenticated access to a publicly reachable URL containing the auction_id parameter, the attack vector is likely network‑based via a standard HTTP request. Exploitability is low to moderate from an operational perspective, but the potential data exposure warrants prompt remediation.