The ZIP Code Based Content Protection plugin for WordPress contains an unauthenticated SQL injection flaw in the 'zipcode' parameter. Because the plugin does not properly escape user input or use prepared statements, an attacker can inject malicious SQL statements, allowing arbitrary queries against the site's database and extraction of confidential data such as user credentials or site configuration.

Presstigers’ ZIP Code Based Content Protection WordPress plugin is affected. All released versions up to and including 1.0.2 contain the vulnerability. WordPress sites that have this plugin installed and have not upgraded to a newer version are at risk.

The flaw has a CVSS score of 7.5, indicating high severity. The EPSS score is less than 1 %, suggesting that the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the injection is unauthenticated and can be triggered via a simple HTTP request to the 'zipcode' parameter, an attacker can easily exploit it from any location.