Improper neutralization of special elements in SQL commands allows an attacker to inject arbitrary SQL statements. In the WP Subscription Forms plugin, this flaw can lead to unauthorized data retrieval, modification, or deletion through crafted form inputs. Although the description does not state code execution, the ability to alter database contents can compromise confidentiality, integrity, or availability of the WordPress site.

All releases of WP Shuffle's WP Subscription Forms plugin up to and including version 1.2.3 are vulnerable. The issue applies to every instance of the plugin, regardless of the WordPress installation. No specific subcomponents or exclusions are enumerated in the advisory.

With a CVSS score of 8.5, the flaw is considered high severity. The EPSS indicates a very low likelihood of exploitation (< 1%), and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via HTTP requests to the plugin's public form endpoint where an attacker can supply malicious form data.