The vulnerability is an improper neutralization of special elements in an SQL command, classified as SQL injection (CWE-89). It resides in the Sticky Radio Player WordPress plugin and permits an attacker to inject arbitrary SQL statements into database queries. Successful exploitation could allow reading, modifying, or deleting database contents that the plugin accesses; if the plugin runs with high database privileges, the attacker might gain persistent access or alter application logic that depends on these database entries.

WordPress sites that have installed the Sticky Radio Player plugin from LambertGroup, version 3.4 or earlier, are affected. The plugin is available from the WordPress repository; the CVE applies to all releases through 3.4. Site administrators should verify their installed version against this affected range.

The CVSS score of 8.5 indicates a high severity of data compromise, while the EPSS score of less than 1 percent suggests the vulnerability is unlikely to be actively exploited at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is through web requests that reach the plugin’s input handling, possibly via the public or admin interface. Unchecked data supplied by an attacker is used directly in an SQL query, meeting the conditions for exploitation as described.