Improper neutralization of special elements in SQL commands in the iCafe Library plugin allows attackers to inject arbitrary SQL statements, potentially enabling the read, modification, or deletion of database content and exposing sensitive information or altering site data.

The flaw affects the WordPress iCafe Library plugin contained in releases from its earliest versions through 1.8.3. WordPress sites deploying this plugin within that range are vulnerable; the vendor identified as cnilsson iCafe Library is the affected product.

With a CVSS score of 7.6 the vulnerability is high severity, yet the EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. Nonetheless, the plugin accepts user‑supplied input at a public endpoint, meaning that an attacker can launch the injection from a remotely reachable location, exposing the site to data compromise unless mitigated.