The flaw permits an attacker to inject statements that are incorporated into an SQL command, as the plugin does not neutralize special characters. Based on the description, this could allow an attacker to read, modify, or delete database contents, compromising confidentiality, integrity, and availability of site data. The issue is classified as CWE‑89.

The WP Music Player plugin developed by hiren.sabd is affected. All releases from the earliest version through 1.3 are vulnerable; no later versions have been identified as safe.

The CVSS score of 7.6 indicates a high severity, yet the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Likely it's exploited via the web interface that accepts user input, allowing remote attackers to send crafted HTTP requests that trigger the unsanitized SQL statements. A successful exploit could lead to full compromise of site data.