The vulnerability is an SQL injection flaw arising from improper neutralization of special elements in an SQL command within the WPListCal plugin, identified as CWE‑89. This flaw allows an attacker to embed malicious SQL code that can read, modify, or delete arbitrary data stored in a WordPress site’s database. Consequently, an attacker could compromise the confidentiality, integrity, and availability of data managed by the plugin.

The affected systems are WordPress installations that use the WPListCal plugin from vendor jonkern. All releases through version 1.3.5 are vulnerable, requiring users running any of these versions to upgrade or remove the plugin.

The CVSS score of 8.5 reflects a high‑severity threat, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is web‑based: an attacker can submit a crafted input payload to the plugin’s SQL queries, potentially targeting any exposed input field that is not sanitized. If successfully exploited, the attacker could achieve full database compromise, leading to data theft or site disruption.