The vulnerability is an unsanitized SQL injection flaw (CWE‑89) in Ofek Nakar’s Virtual Bot WordPress plugin. It allows an attacker to inject crafted SQL through the plugin’s input parameters, earning blind access to the site’s database. Such exploitation can expose, alter, or delete data stored in the database, thereby compromising the confidentiality and integrity of all content managed by the WordPress installation.

WordPress sites that have installed Ofek Nakar:Virtual Bot, versions up to and including 1.0.0. All releases identified as being from the initial release through the stated maximum affected version are impacted.

The CVSS score of 9.3 classifies this flaw as critical. While the EPSS score of less than 1% indicates a low current likelihood of exploitation, the vulnerability is publicly documented and has no known active exploits, so the risk remains significant if the plugin is actively exposed to the internet. It is not listed in the CISA KEV catalog. The attack vector is remote, via web application input that is concatenated directly into SQL queries. An attacker with the ability to submit requests to the plugin’s endpoints can perform privileged database operations once the injection is confirmed.