The vulnerability is a classic SQL injection flaw in the Shamalli Web Directory Free WordPress plugin, allowing an attacker to craft malicious input that is directly incorporated into a database query without proper sanitization. As a result, an attacker can extract sensitive data, modify database contents, or ultimately execute arbitrary SQL commands that could lead to full database compromise or server compromise if further exploits are chained. This flaw is identified as CWE-89.

WordPress sites running the Shamalli Web Directory Free plugin, versions 1.7.6 and below, are affected. The vulnerability persists across all minor releases up to 1.7.6; any site that has not upgraded to 1.7.7 or later is at risk.

The CVSS score of 9.3 places this issue in the critical severity range. However, the EPSS score is reported as less than 1%, indicating a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA's KEV catalog. Attackers would most likely exploit the flaw through a crafted HTTP request to the plugin’s exposed endpoint, potentially without authentication, though the exact conditions are not detailed in the advisory.