This flaw is an SQL injection vulnerability in the Yamna Khawaja Mailing Group Listserv plugin for WordPress. An attacker who can inject malicious SQL into the plugin’s queries can read, modify, or delete data in the database, potentially escalating privileges or facilitating further attacks. The weakness is classified as CWE-89."

The vulnerability affects the Mailing Group Listserv plugin up through version 3.0.4. Any WordPress installation that has this plugin installed and has not been updated beyond that version is susceptible.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests that exploitation prevalence is currently low. The plugin is not listed in the CISA KEV catalog. Based on the description and typical WordPress plugin exposure, the most likely attack vector is remote via crafted HTTP requests to the plugin’s endpoints. The vulnerability allows the execution of arbitrary SQL commands, which could compromise data confidentiality, integrity, and potentially lead to remote code execution if the database interacts with other systems or if default credentials are used.