The Behance Portfolio Manager plugin for WordPress contains a flaw that stems from improper neutralization of special elements used in an SQL command. This allows an attacker to embed malicious SQL into user-controllable input, leading to the execution of arbitrary queries against the website’s database. The vulnerability is classified as CWE‑89 and can be used to read, modify, or delete data stored in the database, thereby compromising the confidentiality, integrity, or availability of the WordPress installation.

WordPress sites that have installed the Eleopard Behance Portfolio Manager plugin in any version through 1.7.5 are affected. Versions 1.7.6 and later are believed to have the issue addressed, and are not included in the scope of this vulnerability.

The CVSS score of 8.5 marks this as a high severity issue, while the EPSS score of less than 1% indicates that exploitation has not been seen widely yet but remains possible. The flaw originates from unsanitized input being included directly in database queries; therefore any endpoint that accepts user input and builds an SQL statement is a potential attack vector. Because the impact is on the database, an attacker could gain data disclosure, data modification, or full site compromise if successful.