The Design Import/Export plugin for WordPress is vulnerable to SQL Injection through the XML file import function. Because the plugin fails to escape user supplied data and does not use prepared statements, an attacker who can upload a crafted XML file can insert additional SQL statements into the existing database query. This flaw, identified as CWE-89, enables the extraction of sensitive information from the database by virtue of the elevated privileges afforded to the attacker. The vulnerability therefore primarily threatens data confidentiality.

All installations of the xul Design Import/Export – Styles, Templates, Template Parts and Patterns plugin up to and including release 2.2 are affected. The flaw is only reachable when an authenticated user with administrator-level privileges imports an XML file; users without such elevated rights cannot trigger the vulnerability.

The CVSS score of 4.9 signals moderate severity, largely limited to confidentiality impact. The EPSS score of less than 1% indicates that, as of the time of analysis, exploitation attempts are expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker who compromises an administrator account or gains legitimate admin access could insert arbitrary SQL, read private data, and potentially manipulate database contents. The risk remains moderate but is confined to environments where privileged accounts are exposed.