The Yawave WordPress plugin is vulnerable to an unauthenticated SQL injection via the 'lbid' parameter in all versions up to 2.9.1, due to unsanitised input and lack of query preparation. Attackers can append arbitrary SQL statements to the existing query, allowing extraction of sensitive database contents. This flaw is a classic input validation weakness identified as CWE‑89, and it can compromise the confidentiality and integrity of site data.

Affected systems include any WordPress site running the Yawave plugin, specifically versions 2.9.1 or older. The plugin is distributed under the product identifier yawave. Users who have installed these versions are at risk until they upgrade or remove the plugin.

The vulnerability carries a CVSS score of 7.5, indicating a high severity, and an EPSS score of 1 %, meaning that exploitation likelihood is currently low but not negligible. It is not listed in the CISA KEV catalog. The problem can be exploited by any unauthenticated user via a crafted HTTP request targeting the shortcode.liveblog.php endpoint, showing that the attack vector is network accessible and does not require administrative access.