This vulnerability is an SQL injection that permits an attacker to execute arbitrary SQL statements against the database. It results from improper neutralization of special elements in an SQL command, allowing a malicious user to gain full confidentiality, integrity and availability compromise of the exposed data. The likely attack vector is a web request that supplies crafted input to a vulnerable parameter; this inference is made because the description does not specify the exact endpoint but mentions a plugin‑level flaw.

The flaw affects WordPress sites that use the AmentoTech Workreap plugin, versions from the first release up to and including 3.3.6. Any site deploying this plugin within that version range is susceptible.

The CVSS score of 8.5 marks the issue as high severity. The EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no authentication requirements are disclosed in the description, implying the potential for unauthenticated exploitation.