The vulnerability is a classic SQL injection flaw caused by improper neutralization of special characters within an SQL command. An attacker can supply crafted input through the plugin’s interface to manipulate the underlying database. This flaw is exploitable without authentication, allowing the attacker to retrieve, modify, or delete data stored by the WordPress site, potentially compromising confidentiality, integrity, and availability of the affected application.

The attack targets the WordPress plugin Neon Product Designer developed by Vertim, affecting all installations of the plugin version 2.2.0 and earlier. Any site running this plugin is at risk if it has not been upgraded or removed.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of less than 1% suggests a low current exploitation probability, though the vulnerability is listed as not in the CISA KEV catalog. The attack vector is inferred to be remote, via unauthenticated HTTP requests to the plugin’s endpoints, allowing an attacker to inject malicious SQL statements. If successful, the attacker could gain unrestricted command execution against the database layer.