The Ultimate Auction Pro plugin is vulnerable to unauthenticated SQL injection through the auction_id parameter. Because the parameter is not properly escaped nor is the underlying query prepared, an attacker can append arbitrary SQL statements to the existing query, allowing extraction of sensitive database information. This is a classic CWE‑89 vulnerability that can compromise data confidentiality but does not directly enable code execution on the host.

All installations of Inception Software LLP’s Ultimate Auction Pro WordPress plugin with version 1.5.2 or earlier are affected. The plugin operates as a WordPress extension and utilizes the auction_id parameter in HTTP requests to retrieve auction data. Any site using these versions of the plugin without applying an update is at risk.

The CVSS score of 7.5 indicates a high impact risk, and the EPSS value of less than 1% suggests that exploitation of this weakness is unlikely in the wild at this time. Nevertheless, the vulnerability is listed as not part of CISA’s KEV catalog. An attacker can exploit the flaw by sending a crafted HTTP request containing malicious SQL to the auction_id parameter, potentially in a public or untrusted page. Given the unauthenticated nature of the attack, a remote attacker with access to the site can trigger the injection without needing privileged credentials.