This vulnerability is an instance of Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). An attacker who can control the input to the teachPress plugin could inject arbitrary SQL statements into queries that are then executed by the underlying database. The impact includes unauthorized read, modification, or deletion of data stored in WordPress, potentially compromising confidentiality, integrity, and availability of the site’s content and user information. The weakness is a classic CWE‑89 SQL injection flaw.

The affected product is the WordPress teachPress plugin, version 9.0.11 and all earlier releases. The vulnerability is listed for the vendor winkm89 under the teachPress product.

The CVSS score of 8.5 indicates high severity. The EPSS score is less than 1%, suggesting that the likelihood of a real‐world exploit is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web request that includes malicious input accepted by the plugin. Based on the description, the attacker can exploit this flaw by submitting specially crafted requests to the plugin’s interfaces; the vulnerability can be triggered without authentication or with minimal privileges if the plugin is exposed to the public.