A flaw in the WP Inquiries plugin allows an attacker to inject arbitrary SQL commands, owing to a lack of proper input sanitization (CWE-89). If the injection succeeds, the attacker could read, modify, or delete any data that the plugin stores in the database, potentially exposing user information or compromising the entire WordPress site.

The vulnerability exists in Aristo Rinjuang’s WP Inquiries plugin versions 0.2.1 and earlier. Any WordPress installation that has not upgraded beyond those versions is at risk. The plugin is commonly used on WordPress 5.x and later, so many sites may still be running a vulnerable copy.

The CVSS score of 7.6 signals high severity while the EPSS score of < 1% indicates that exploitation attempts are currently uncommon but not impossible. The vulnerability does not appear in the CISA KEV catalog, so no confirmed wild‑world exploitation is known. The likely attack vector is via the plugin’s web interface, as an attacker can craft HTTP requests to the plugin’s endpoints to inject SQL—a conclusion inferred from the plugin’s description of accepting unsanitized input. Administrators should evaluate the potential data exposure and apply mitigations promptly.