This vulnerability is a classic SQL injection flaw (CWE‑89) that exists in the WP AutoKeyword plugin for WordPress. The plugin fails to properly neutralize special characters before incorporating user‑supplied data into SQL statements. An attacker who can influence these inputs can inject arbitrary SQL, enabling unauthorized read or write access to the site’s database.

The affected product is EXEIdeas International’s WP AutoKeyword plugin for WordPress, versions up to and including 1.0. Sites that have installed this plugin before the fix are at risk. Any WordPress installation that hosts this plugin, regardless of other security measures, is potentially vulnerable.

The vendor’s CVSS score of 9.3 highlights a high severity with full confidentiality, integrity, and availability impact if exploited. The EPSS score of less than 1% indicates a currently low probability of exploitation, and the vulnerability is not yet in the CISA KEV catalog. Still, the attack vector is likely through publicly accessible plugin endpoints where input is not sanitized, so organizations should treat this as a serious risk. A compromise could result in data theft, corruption, or site defacement once the database is accessed.