The vulnerability is an SQL Injection flaw where user-controlled input is not properly sanitized before being embedded into an SQL command. If exploited, an attacker could read, modify, or delete data in the WordPress database, potentially compromising all stored customer or transaction information and disrupting the site’s operation. This weakness aligns with CWE‑89 and presents a severe threat to confidentiality, integrity, and availability. The CVSS score of 9.3 indicates a critical severity, with the potential for full compromise if the application processes untrusted input.

The affected product is the WordPress plugin WPCRM – CRM for Contact form CF7 & WooCommerce by mojoomla. Versions from the earliest released through 3.2.0 are vulnerable. No other products or versions are listed.

The EPSS score is reported as less than 1%, suggesting that widespread exploitation is unlikely at this time, yet the high CVSS score warrants immediate attention. The vulnerability is not listed in the CISA KEV catalog, but its critical score and potential for data leakage demand prompt remediation. The likely attack vector is via HTTP requests that contain malicious input to the plugin’s form handling or API endpoints, though the exact path is not detailed in the description. If an attacker can supply arbitrary SQL fragments, they can execute commands against the underlying database. Maintaining current plugin versions or applying vendor patches removes the vulnerability entirely.