Improper Neutralization of Special Elements in an SQL command allows a blind SQL injection in the Absolute Links plugin. A successful exploitation could enable an unauthenticated attacker to read database contents through inference, though the description does not explicitly state that data can be modified or deleted. This weakness is a classic SQL Injection (CWE‑89), which jeopardizes the confidentiality of the underlying MySQL database.

The vulnerability affects the Absolute Links plugin developed by Amir Helzer, all releases from the earliest version through version 1.1.1 inclusive. No other vendors or products are listed as affected.

The CVSS score of 7.6 indicates a high‑severity flaw, while the EPSS score of less than 1% suggests a low exploitation probability at the present time. The flaw is not present in the CISA KEV catalog. Based on typical plugin behavior, the likely attack vector is a web‑based request to the plugin’s endpoint where user‑supplied parameters are passed directly into a database query without proper sanitization. An attacker with access to the site could craft such a request and trigger the blind SQL injection to gain unauthorized database access.