This issue occurs when the Schedule plugin accepts user input without appropriately escaping special characters that are then incorporated into an SQL query, resulting in blind SQL injection, a CWE-89 weakness. An attacker who can influence the plugin’s parameters can extract sensitive data from the database, modify records, or potentially inject additional malicious SQL statements, leading to unauthorized data disclosure or integrity compromise.

WordPress sites using the Schedule plugin version 1.0.0 or earlier are affected. The plugin is distributed under the scheduler:Schedule identifier and is available in the WordPress repository as the Schedule plugin.

The CVSS score of 9.3 places this flaw in the critical severity range, indicating a high potential impact if exploited. The EPSS score of less than 1% suggests that, while the vulnerability is severe, it is not widely expected to be actively exploited at present. The flaw is not yet listed in CISA’s KEV catalog. Attackers would need to supply crafted input to the plugin’s exposed parameters—most likely via the web interface—making the vector a local or remote web-based attack depending on the plugin’s exposure.