The flaw is an improper neutralization of special elements in SQL commands that gives attackers blind SQL injection via the WordPress Business Directory plugin. Because the input is not correctly sanitized, a malicious query can be injected, allowing an attacker to read sensitive data, modify or delete records, or execute other database commands, all of which constitute a severe breach of confidentiality and integrity. The vulnerability is categorized as CWE‑89. The reported CVSS score of 9.3 signals critical severity.

Vulnerable to any installation of the WP‑BusinessDirectory plugin from CMSJunkie that is version 3.1.4 or older. The issue is present in all releases from the earliest listed (n/a) up to and including 3.1.4; newer releases are not affected.

The vulnerability’s CVSS score of 9.3 and an EPSS score of less than 1% illustrate a critically high impact but very low exploitation probability. It is not currently listed in the CISA KEV catalog, suggesting no widely known exploits have been reported. Attackers can exploit the flaw remotely by sending crafted requests to the plugin’s input fields, which lack proper sanitization, and gain access to the underlying database through blind injection techniques. The likely vector is over the web interface, requiring only that the site hosts the affected plugin version and that the input endpoints are reachable.