The Page Expire Popup/Redirection for WordPress plugin contains a time‑based SQL injection in the 'id' attribute of its shortcode. Because the attribute value is inserted into an SQL statement without proper escaping or use of prepared statements, an attacker who owns an authenticated Author or higher role can append malicious SQL to the existing query. The attacker can therefore retrieve arbitrary database records, potentially exposing usernames, passwords, configuration data, and other sensitive information.

Any WordPress installation that has the Page Expire Popup/Redirection plugin version 1.0 or earlier is affected. Site administrators should check the plugin version in the Plugins page and document whether the vulnerable version is active.

The CVSS score of 6.5 indicates a moderate severity with an exploit requiring authentication. The EPSS score of less than 1% signals that the vulnerability is unlikely to be actively exploited in the wild. Because the attack vector needs a legitimate author account, the risk is further mitigated by a strong password and limiting author privileges. The vulnerability is not currently listed in the CISA KEV catalog.