The vulnerability is an improper neutralization of special elements used in an SQL command, allowing blind SQL injection into the WordPress JiangQie Official Website Mini Program plugin. An attacker could send crafted input to the plugin’s request parameters, causing the application to execute unintended SQL statements and potentially read, modify, or delete data in the database. The impact is a compromise of data confidentiality, integrity, and availability in the affected WordPress site.

The affected product is the JiangQie Official Website Mini Program plugin for WordPress, versions from the unspecified earliest release through 1.8.2. Sites running any of these versions are susceptible, and the problem exists within the plugin’s code that processes user-supplied data.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1% suggests currently low exploitation probability. The weakness is listed as CWE-89 and is not in CISA’s KEV catalog. Attackers can exploit this by issuing specially crafted HTTP requests to the plugin’s input endpoints; it is inferred that no authentication is required, making it widely reachable to potential threat actors.