This vulnerability is an instance of SQL Injection that arises from improper neutralization of special elements used in an SQL command. An attacker who can supply malicious input to the plugin's processing logic can cause the underlying database to execute arbitrary SQL statements. The result is the compromise of database confidentiality, integrity, and potentially availability, allowing attackers to read, modify, or delete data stored in the WordPress database.

The Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin developed by AA‑Team is affected when its version is 1.2 or earlier. The vulnerability applies to all releases from the plugin's inception through the 1.2 release milestone.

The CVSS score of 8.5 reflects a high severity attack potential. The EPSS score of less than 1% indicates a low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to submit crafted input to the plugin’s interface or a shortcode that the plugin parses, which may be publicly accessible. Once the injection succeeds, the attacker can execute any SQL command supported by the database engine used by the WordPress installation.