The vulnerability is an improper neutralization of special elements used in an SQL command (CWE‑89). The affected plugin incorporates user supplied data directly into database queries, enabling blind SQL injection. Successful exploitation would allow an attacker to read or modify arbitrary database records, potentially rendering the site unavailable, leaking sensitive data, or facilitating further attacks such as data exfiltration or ransomware.

WordPress sites using the DynamicTags plugin by rtowebsites, version 1.4.0 or earlier. All releases from the plugin’s inception through 1.4.0 are affected.

The CVSS score of 8.5 classifies this issue as high severity, and the EPSS score of <1% indicates a low probability of exploitation under current conditions. It is not listed in the CISA KEV catalog. The likely attack vector is a crafted request to the plugin’s interface, which may be reachable by any authenticated or unauthenticated user who can submit data to the vulnerable endpoint. If the attacker can influence the input, blind SQL injection can be achieved, allowing data extraction or manipulation.