The Click & Pledge Connect Plugin contains a classic SQL injection flaw caused by improper neutralization of special elements in an SQL command. The vulnerability allows an attacker to inject arbitrary SQL through user input, potentially leading to unauthorized data read, modification, or deletion. The flaw is a direct instance of CWE-89 and could be exploited to compromise the integrity and confidentiality of the site's database.

Affected installations are those running Click & Pledge Connect Plugin versions 2.24080000 through WP6.6.1. Any WordPress site that has not upgraded past these releases is vulnerable.

The CVSS score of 7.2 marks this vulnerability as high severity, but the EPSS probability is less than 1%, indicating a low current exploitation likelihood. It is not listed in CISA’s KEV catalog. The likely attack path involves sending crafted HTTP requests to plugin-controlled endpoints, with no special privileges required beyond the ability to access the vulnerable site.