The AHAthat Plugin for WordPress, versions up to 1.6, is vulnerable to a time‑based SQL injection through the 'id' parameter because user input is insufficiently escaped and the query is not properly prepared. The flaw permits an attacker who has Administrator‑level or higher credentials to append arbitrary SQL statements to the existing query, enabling extraction of sensitive data from the database. This is a classic SQL injection flaw, identified as CWE‑89.

The vulnerability affects the plug‑in "AHAthat Plugin" developed by Mitchell Levy. All releases with a version number of 1.6 or earlier are impacted; newer versions released after 1.6 are not known to contain this issue.

The CVSS score of 4.9 indicates a moderate risk, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. Because the flaw requires administrative access, it does not pose an immediate threat to public users, and it is not listed in CISA’s KEV catalog. However, an attacker who compromises an administrative account could run additional queries to read or delete data, making the impact potentially significant for the affected site. The attack vector is likely via normal use of the WordPress admin area where the 'id' parameter can be supplied.