The vulnerability is an improper neutralization of special elements used in an SQL command, classified as an SQL injection flaw (CWE-89). An attacker can supply crafted input that causes the plugin to execute SQL statements against the database. Because the flaw is specifically noted as a blind injection, the attacker may not see immediate output but can infer information about the database contents through time delays or error messages, potentially exposing sensitive data stored in WordPress tables.

Lisandro Martinez’s WPSmartContracts WordPress plugin, versions up to and including 2.0.12, is affected. The issue is present from the earliest available release through version 2.0.12.

The CVSS score of 9.3 indicates high severity. The EPSS score of less than 1% suggests that exploitation probability is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely deliver malicious input via web requests to the WordPress site hosting the vulnerable plugin, attempting to extract data through blind SQL injection techniques.