A Cross‑Site Request Forgery flaw in the Awesome Logos plugin lets an attacker force an authenticated user to execute arbitrary SQL statements against the WordPress database. The vulnerability allows the injection of malicious code that can read, modify, or delete data, potentially compromising the confidentiality, integrity, and availability of the site content and user information.

The WordPress plugin Awesome Logos from wpshopee, versions up to and including 1.2, is affected. No other vendors or products are listed as impacted.

The CVSS score of 9.3 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by luring a logged‑in administrator or user to visit a crafted link or form that triggers the CSRF request, enabling the injection of arbitrary SQL. Due to the remote nature of the attack and the high potential impact, the risk is significant for any site still running an affected version of the plugin.