The vulnerability is an improper neutralization of special elements used within an SQL command in the Pinterest Automatic Pin plugin. Attackers can inject arbitrary SQL statements that may read, modify, or delete data in the WordPress database, potentially exposing sensitive information or altering site content. The weakness corresponds to CWE‑89.

This issue affects WordPress installations running the Pinterest Automatic Pin plugin from any released version up to, but not including, 4.19.0. The plugin is distributed by ValvePress and commonly used to auto‑save Pinterest images to sites.

The CVSS score of 8.5 indicates a high severity rating, meaning that if exploited the impact can be significant. The EPSS score is listed as less than 1%, suggesting that active exploitation is currently unlikely, and the vulnerability is not yet catalogued in CISA’s KEV list, which increases confidence that it has not been widely exploited in the wild. The likely attack vector is through standard HTTP requests to the plugin’s exposed endpoints, so anyone with network access to the site may attempt junk input that can be processed without adequate sanitization.