The vulnerability is an improper neutralization of special elements in SQL commands, classified as a SQL injection flaw. An attacker who succeeds in injecting malformed SQL could read, modify, or delete data stored in the WordPress database. This transforms the plugin into a conduit for unauthorized database operations, compromising confidentiality, integrity, and potentially availability of site data.

The WordPress plugin Simple Giveaways, authored by Igor Benic, is vulnerable in all releases up to and including version 2.48.1. The issue originates in code that constructs raw SQL statements without proper sanitization. Any WordPress site running one of these affected versions is at risk.

The CVSS score of 8.5 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation is currently infrequent, and the vulnerable code is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to involve user‑controlled input to the plugin’s functionality—such as form or URL parameters—though the exact input point is not explicitly stated in the CVE notes.