Renzo Tejada’s Libro de Reclamaciones y Quejas plugin contains an SQL Injection flaw that allows an attacker to inject malicious SQL commands. This weakness can result in unauthorized access to the database, enabling confidential data disclosure, alteration of records, or potential deletion of critical information. The vulnerability stems from insufficient input validation when building database queries, as identified by CWE‑89.

WordPress installations running the Libro de Reclamaciones y Quejas plugin version 0.9 or earlier are affected. The vulnerability is present from the initial release up to and including 0.9 and does not affect later releases if updated.

The CVSS score of 7.6 classifies this as a high severity flaw, but the EPSS score of less than 1% indicates a low probability of exploitation in the current landscape. It is not marked in the CISA KEV catalog. Attackers could exploit this via crafted HTTP requests to the plugin’s endpoints, potentially without authentication if the plugin processes user-supplied data indiscriminately. Precise prerequisites are not detailed, but the lack of input sanitization suggests remote exploitation from any user with network access to the site.