The gopiplus Cool fade popup WordPress plugin contains a blind SQL injection flaw caused by improper neutralization of special elements in SQL statements. An attacker can supply crafted input that bypasses parameter sanitization, allowing the execution of arbitrary SQL commands. The weakness can be used to read sensitive information or modify database records, potentially exposing users’ data or compromising site content.

Any WordPress site running the Cool fade popup plugin version 10.1 or earlier is affected. The plugin is distributed by gopiplus and is identified by the name Cool fade popup.

The CVSS score of 8.5 indicates a high severity with substantial impact on confidentiality and integrity. The EPSS score of less than 1% suggests that, as of now, the vulnerability is not widely exploited, and it is not listed in the CISA KEV catalog. The likely attack vector is through an HTTP request to the plugin’s input handling endpoint, and an attacker would need the ability to send crafted data (e.g., via a user account or a publicly exposed form). These details are inferred from the description and the nature of typical SQL injection attacks when no explicit vector is provided.