The vulnerability arises from improper neutralization of special elements in SQL commands within the Felan Framework plugin. This flaw allows an attacker to inject arbitrary SQL statements, potentially retrieving, modifying, or deleting database contents. An attacker could gain unauthorized access to sensitive data or cause data loss.

RiceTheme’s Felan Framework plugin versions from the initial release up to and including 1.1.3 are affected. Any WordPress site deploying these plugin versions is at risk.

The CVSS score of 9.3 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the short term. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote input via the plugin’s front‑end interface, requiring user‑supplied parameters to craft malicious SQL.