The vulnerability is a classic SQL injection flaw caused by failure to properly neutralize special elements used in SQL commands. An attacker who can supply data to vulnerable plugin interfaces can inject arbitrary SQL, enabling unauthorized reading, modification, or deletion of database content and potentially execution of malicious code. This could lead to full control over the site and its data.

The flaw exists in the Aldo Latino PrivateContent plugin, a popular WordPress plugin used for restricting access to content. Versions from the earliest release up to and including 8.11.4 are affected. Any WordPress site that has this plugin installed at the mentioned versions is potentially vulnerable.

The CVSS base score of 8.5 classifies the issue as high severity. The EPSS calculation indicates a very low likelihood (<1%) that an exploit is actively being used in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the web‑based nature of the WordPress plugin makes a remote attacker able to trigger the injection simply by submitting crafted input on a publicly accessible page, provided the plugin handles such input. The vulnerability relies on common SQL injection weaknesses (CWE-89) and therefore requires no special prerequisites beyond access to the vulnerable endpoint.