The DASHBOARD BUILDER WordPress plugin contains a Cross‑Site Request Forgery vulnerability in versions up to 1.5.7. Because the settings handler does not validate a nonce, an attacker can send a forged request that an administrator will accept. This can change the plugin's stored SQL query and database credentials that the [show‑dashboardbuilder] shortcode uses. When the shortcode is rendered on the front‑end, the altered query is executed, allowing the attacker to perform arbitrary SQL injection and extract data from the database. The weakness belongs to CWE‑352.

All WordPress sites with the Dashboard Builder plugin v1.5.7 or earlier are affected. The vendor is a WordPress plugin called Dashboard Builder – WordPress plugin for Charts and Graphs. No other software, OS or core WordPress versions are specified, so the impact applies to every installation that has not moved beyond 1.5.7.

The CVSS score of 7.1 signals high severity, while the EPSS score of less than 1 % indicates a low but nonzero likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker only needs to entice an administrator to visit a crafted link or click a button, and no authentication is required. Successful exploitation grants the ability to inject arbitrary SQL, which can lead to unauthorized data exfiltration or further compromise of database permissions.