The vulnerability arises from improper neutralization of special elements in SQL commands within the SHOUT plugin, allowing an attacker to inject arbitrary SQL statements. This can enable unauthorized reading, modification, or deletion of the database, potentially exposing site content, user data, and configuration settings. The weakness is classified as CWE-89.

The SHOUT plugin from LambertGroup (lbg-audio8-html5-radio_ads) is affected for all releases up to and including version 3.5.3. No additional version details are provided.

The CVSS score of 8.5 indicates high severity, while an EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. Attackers would likely exploit it through HTTP requests to the plugin, sending specially crafted input that bypasses input sanitization to execute arbitrary SQL commands. Successful exploitation could provide read or write access to the underlying database and, by extension, the site.