The Torod plugin for WordPress contains an SQL injection flaw caused by insufficient neutralization of special characters in SQL commands. This weakness (CWE-89) permits an attacker to inject arbitrary SQL statements, potentially enabling the attacker to read, modify, or delete data stored in the site database. The CVE description does not reference code execution or privilege escalation beyond database manipulation.

Affected versions are all releases of the Torod plugin from Torod Company for Information Technology from the initial launch through version 2.1. No later releases are listed as fixed.

With a CVSS score of 9.3 the vulnerability is classified as critical, but the EPSS score of less than 1% indicates a very low probability of exploitation at present, and the flaw is not included in CISA’s KEV catalog. The likely attack vector is remote via web input fields processed by the plugin; this inference is drawn from the fact that the injection occurs through user‑supplied data that reaches an SQL statement. Exploitation would require the ability to submit data to the plugin, making the flaw widely reachable if no other controls are in place.