The Office Locator plugin for WordPress contains an SQL Injection vulnerability that arises from improper neutralization of special elements in SQL commands. By submitting crafted input to the plugin’s fields, an attacker can inject arbitrary SQL statements that read or modify the underlying database. This can lead to data leakage, corruption, and unauthorized access to sensitive information stored in the site’s database, compromising confidentiality and integrity.

All installations of the WebbyTemplate Office Locator plugin for WordPress that are running a version up to and including 1.3.0 are affected. The vulnerability exists in every release prior to the fix released in version 1.3.1.

The CVSS score of 9.3 and a very low EPSS (< 1%) indicate a high potential impact with a currently low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely unauthenticated and remote, delivered through the plugin’s exposed input fields in the website’s front‑end or admin interface. Successful exploitation would allow an attacker to execute arbitrary SQL against the site’s database.