The vulnerability exists in the Code Clone plugin for WordPress and is a time‑based SQL injection that targets the snippetId parameter in the admin snippet‑edit.php file. Because the plugin does not escape the user‑supplied value or properly prepare the query, an attacker who is already authenticated with Administrator rights can inject additional SQL statements. This ability allows the attacker to read sensitive data from the database and compromise the integrity of the stored information. The weakness is a classic application typo‑injection flaw.

All users of the Code Clone plugin by Allhart, with affected versions up to and including 0.9. WordPress sites running this plugin version are at risk if an administrator account is compromised. The vulnerability is limited to environments where the plugin’s administrative interface is accessible.

The CVSS base score of 4.9 indicates a moderate severity. Current EPSS submissions show a very low exploitation probability (< 1 %) and the issue is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is unlikely at present. However, because the flaw requires administrator privileges, any site with weaker access controls or an exposed admin account could be vulnerable. The risk is considered moderate, but because the attack vector depends on an authenticated user, the best practice is to patch as soon as the update becomes available.