The vulnerability is an instance of CWE-89, where improper neutralization of special elements allows an attacker to inject and execute arbitrary SQL commands against the WordPress database. An adversary who can supply crafted input could read sensitive data, modify or delete records, and potentially disrupt site functionality. This compromises the confidentiality, integrity, and availability of the site’s data.

Any WordPress site running the SEO Squirrly SEO Plugin by Squirrly SEO with a version up to and including 12.4.03 is affected. The vendor is SEO Squirrly: SEO Plugin by Squirrly SEO. No other product or version information is provided.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that, at the time of analysis, the probability of exploitation is currently low, and it is not listed in the CISA KEV catalog. The likely attack vector is remote via web interfaces that accept user input into the plugin’s configuration or submission pages. Bypassing authentication or requiring only standard user access cannot be confirmed from the data, so it is inferred that an attacker could exploit the flaw through publicly accessible plugin endpoints if not properly restricted.