The vulnerability arises from improper neutralization of special elements within SQL commands, enabling a blind SQL injection attack. An attacker can craft malicious input that is not properly validated, allowing them to execute arbitrary SQL queries against the database. The primary consequence is unauthorized access to sensitive data, including the potential to manipulate or delete database contents, and if extended, to compromise the application. The weakness is classified as CWE-89 and carries a CVSS score of 9.3, indicating a severe security flaw.

The flaw affects the WordPress WPGYM plugin developed by Mojoomla. All plugin releases from the earliest version up to and including 65.0 are vulnerable. WordPress sites that have the WPGYM plugin installed in these versions are at risk.

Given the high CVSS score of 9.3 and the very low EPSS probability (<1%), the vulnerability is technically dangerous but exploitation likelihood is presently low. It is listed as not being part of the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be an external, authenticated or unauthenticated web request that targets the plugin’s input handling. An attacker would need to observe response changes (blind injection) to confirm the success of the injection. Once successful, the attacker can read or modify database content as permitted by the underlying database credentials used by WordPress.