The WP Guru Error Log Viewer plugin contains an improper neutralization of special elements in an SQL command, enabling a blind SQL injection attack. An attacker who can supply input to the plugin’s data requests can cause the application to execute arbitrary SQL statements and retrieve sensitive database information. The exploit does not directly lead to remote code execution but can compromise data confidentiality and integrity for the target WordPress site.

WordPress sites that have installed WP Guru:Error Log Viewer version 1.0.5 or earlier are affected. No other versions are listed as impacted.

The CVSS base score of 8.5 classifies this flaw as high severity. The EPSS score is below 1 %, indicating a low yet non‑zero likelihood of exploitation, and the vulnerability is not present in the CISA KEV catalog. The attack vector is inferred to be via HTTP requests to the plugin’s interface, typically by a user with access to the admin area or by unauthenticated users if the plugin is exposed publicly. Mitigation depends on applying the vendor’s patch or disabling the plugin.