The WordPress Custom Sidebar plugin contains an SQL injection flaw due to improper neutralization of special elements in an SQL command. A remote attacker can exploit this blind injection to read or modify the site's database, potentially exposing sensitive content or altering site configuration. The weakness is classified as CWE‑89 and can lead to data disclosure, tampering, and, if privilege escalation is possible, further compromise of the host.

Affected products are WordPress installations that employ the WordPress Custom Sidebar plugin developed by Philipp Speck, versions from the initial release through 2.3. Users running any earlier release that has not been patched to a newer version remain vulnerable.

The CVSS score of 8.5 indicates high severity, while the EPSS of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely trigger the issue via the plugin’s exposed web interface or publicly accessible sidebar widgets, without needing authentication, and the injection is blind, relying on timing or error behavior.