The vulnerability resides in the WordPress plugin Contact Us page - Contact people LITE. Improper neutralization of special elements used in an SQL command allows an attacker to inject arbitrary SQL when submitting the contact form. This could enable the execution of SQL statements that read, modify, or delete database contents, potentially exposing sensitive data or disrupting site functionality.

Affected systems are websites running the WordPress Contact Us page - Contact people LITE plugin version 3.7.4 or earlier. The plugin is commonly used to provide a contact form; any site that has installed this plugin without upgrading to a newer version is at risk.

The CVSS base score of 8.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild today. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits are publicly documented. Attackers likely need to find a way to submit crafted input via the publicly exposed contact form; no authentication is required, making the vector readily available. Because of the high impact, fixing the software promptly is essential.