The enituretechnology Small Package Quotes – Worldwide Express Edition plugin contains an improper neutralization of special elements in an SQL command, allowing an attacker to inject arbitrary SQL. If exploited, a malicious actor could read, modify, delete or otherwise tamper with the WordPress site's database content, potentially exposing sensitive information or disrupting site functionality. The weakness is a classic SQL injection flaw (CWE-89).

WordPress sites running the enituretechnology Small Package Quotes – Worldwide Express Edition plugin version 5.2.18 or earlier are affected. The vulnerability applies from the earliest available version through <=5.2.18; no later versions appear to contain the flaw. The specific input paths are not detailed in the advisory, so all public-facing plugin interfaces that construct SQL queries without proper sanitization are likely avenues.

The CVSS score is 9.3, reflecting a high severity risk. However, the EPSS score is reported as <1%, indicating a very low likelihood of real-world exploitation at current time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, via the web interface, as the plugin interacts with WordPress request parameters that are passed to the database. The database user associated with WordPress must have sufficient privileges for the attack to succeed, and the lack of proper input validation allows arbitrary query execution.