The vulnerability is a blind SQL injection flaw (CWE‑89) that occurs when user-supplied data is incorporated into an SQL statement without proper escaping. The attacker can send crafted payloads to the plugin’s processing endpoint and infer the result through timing or error responses, which enables them to extract, modify, or delete data in the WordPress database. In the worst case, this could compromise the integrity of site content or elevate privileges if the attacker can exploit the injection to access administrative functions.

The WPFable Fable Extra plugin, any version through 1.0.6, is vulnerable. Any WordPress installation that includes this plugin within the specified version range is at risk.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% means that exploitation is currently expected to be rare. The flaw has not appeared in the CISA KEV catalog, suggesting no large‑scale exploitation campaigns yet. The likely attack vector is via an HTTP request sent to the plugin’s endpoint, where the attacker can inject arbitrary SQL commands and deduce results by observing side‑effects.