The vulnerability originates from improper neutralization of special elements within SQL commands, enabling blind SQL injection through the WP Yelp Review Slider plugin. An attacker can craft malicious input that is executed by the database, potentially exposing, modifying, or deleting sensitive data. This breach compromises both confidentiality and integrity of the site's data and may serve as a foothold for further exploitation.

The WP Yelp Review Slider plugin developed by jgwhite33 for WordPress is affected. Versions from the initial release up to and including 8.1 contain the flaw.

The CVSS score of 7.6 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that a blind SQL injection would most likely be carried out via the web interface, sending crafted input to the plugin’s endpoints. The blind nature of the injection means that exploitation relies on timing or inference techniques rather than immediate error messages.