The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL injection through the 'databeat' parameter because user supplied input is not properly escaped and the query is not prepared. Attackers can append additional SQL statements to the existing query, enabling them to read sensitive data from the database. This vulnerability is an instance of CWE-89 and results in potential loss of confidentiality for the data stored in the WordPress database.

WordPress sites using the WP-Recall – Registration, Profile, Commerce & More plugin, versions 16.26.10 and earlier, are affected by this flaw.

The CVSS score of 7.5 indicates high severity, and the EPSS score of 26% suggests a moderate likelihood of exploitation. Because the attack vector is unauthenticated, an attacker does not need credentials to exploit the flaw, meaning the vulnerability could be used to compromise any site that has not updated the plugin. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploit has been catalogued yet, but the moderate EPSS indicates that exploitation could occur at some point.