The Vimeotheque plugin contains an improper neutralization of special elements used in an SQL command, allowing an attacker to inject arbitrary SQL statements. This flaw can be exploited to read, modify or delete data from the database, potentially exposing sensitive content or altering site functionality. The vulnerability is a classic SQL injection identified by CWE-89, posing a significant risk to confidentiality and integrity of the WordPress site's data.

The flaw affects the Vimeotheque plugin developed by Constantin Boiangiu, specifically versions up to and including 2.3.4.2. Any WordPress installation running these versions is susceptible.

The vulnerability has a CVSS score of 8.5, indicating a high impact if successfully exploited. The EPSS score is less than 1%, suggesting that, at present, the likelihood of active exploitation is low, and it is not listed in CISA's KEV catalog. The likely attack vector is remote, via an attacker accessing the site or submitting crafted input to a plugin endpoint; however, the exact path is inferred from the nature of the SQL injection and typical plugin usage.