The vulnerability arises from improper neutralization of special elements in SQL commands within the Daisycon prijsvergelijkers WordPress plugin. This flaw, classified as CWE‑89, allows an attacker to inject malicious SQL through supplied input, enabling unauthorized data manipulation or extraction. The impact is the potential for data leakage, modification, or disruption of the database.

The affected product is the Daisycon prijsvergelijkers WordPress plugin for the Daisycon platform. Versions from the initial release through 4.8.4 are vulnerable. Site administrators running any of these versions should assess their installations immediately.

The CVSS score of 8.5 reflects high severity, yet the EPSS score indicates a very low probability of exploitation (<1%). The vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. A remote attacker could likely exploit the issue via a crafted HTTP request, potentially without authentication or with minimal privileged access. Successful exploitation would compromise the integrity, confidentiality, or availability of the underlying database.