The vulnerability is an improper neutralization of special elements in an SQL command, permitting attackers to inject malicious SQL through the WordPress Payment Forms for Paystack plugin. This flaw can lead to unauthorized database access, manipulation of stored data, and potential disclosure of sensitive information, as it falls under the SQL Injection weakness (CWE-89).

WordPress sites using the Payment Forms for Paystack plugin by kendysond, any installation from the initial release up through version 4.0.1 is affected. No specific build numbers are detailed beyond the maximum affected version of 4.0.1.

The CVSS score of 7.6 indicates a high severity with potential for severe impact. EPSS is listed as < 1%, suggesting a low probability of exploitation yet still possible. The vulnerability is currently not in the CISA KEV catalog. Attackers can exploit this remotely via crafted HTTP requests to the plugin’s payment form endpoints, assuming the plugin is active and accessible, though this attack vector is inferred from the description and not explicitly stated in the input.