WordPress sites that use the Nks Email Subscription Popup plugin up to version 1.2.23 suffer from a blind SQL injection flaw. The vulnerability stems from improper neutralization of SQL input, allowing attackers to embed malicious SQL commands. This exploit can read or alter data stored in the WordPress database, potentially compromising the confidentiality and integrity of site content.

This vulnerability affects WordPress installations that have the Nks Email Subscription Popup plugin at version 1.2.23 or earlier. The plugin includes an email‑subscription component that accepts user input. Based on the description, it is inferred that the subscription interface is publicly reachable, permitting unauthenticated users to submit data that is processed by the plugin.

The CVSS score of 7.6 marks this flaw as high severity, while the EPSS score of 31% indicates a moderate likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, involves sending specially crafted input through the subscription form or related API endpoint to exploit the blind SQL injection and extract or modify database records.