The vulnerability is an SQL injection flaw in the iDo8p WPMU Prefill Post plugin for WordPress. Because the plugin improperly sanitizes user input before including it in an SQL statement, an attacker can inject arbitrary SQL code. An adversary could read, modify, or delete data in the database, potentially escalating to full site compromise if privileged users can craft the request.

WordPress sites utilizing the WPMU Prefill Post plugin up through version 1.02 are impacted. This includes all installations that have not upgraded beyond the stated maximum. The plugin is distributed by iDo8p. No specific operating system or WordPress core version limitations are noted.

The CVSS score of 7.6 indicates a high severity. The EPSS score of less than 1% suggests low observed exploitation likelihood. Because the vulnerability is not listed in the KEV catalog, no active exploits are known. The likely attack path involves interacting with a vulnerable instance of the plugin through its publicly accessible interface, potentially requiring attacker-controlled parameters. Without further evidence, it is best to treat it as a serious but low‑probability risk.