The vulnerability allows an authenticated user with Subscriber or higher level access to insert malicious SQL queries via the 'search' parameter. The insufficiency of escaping and lack of prepared statements permits the attacker to execute additional SQL commands that read sensitive database information, thereby compromising confidentiality. The flaw does not directly grant code execution but enables privileged extraction of data.

The flaw exists in the SEO Plugin by Squirrly SEO for WordPress, affecting all releases up to and including version 12.4.05. The plugin is distributed as part of the WordPress ecosystem under the cifi vendor identifier. No specific distribution channel is mentioned beyond WordPress.

With a CVSS score of 6.5 the vulnerability is considered a moderate severity issue. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV, suggesting no current widespread exploitation. The most probable attack vector is through a valid WordPress account with Subscriber-level permissions, as the plugin’s features are available only to authenticated users. Accordingly, the overall risk depends on the presence of such accounts and the potential exposure of sensitive data rather than on the likelihood of a public exploit.