The vulnerability resides in Rustaurius Ultimate WP Mail versions up to 1.3.4 and allows attackers to inject arbitrary SQL statements into commands executed by the plugin. This flaw arises from improper neutralization of special elements used in an SQL command, as defined by CWE-89. Successful exploitation could give an attacker read or write access to the database, potentially leading to credential exposure or further compromise of the website.

WordPress sites running the Ultimate WP Mail plugin from Rustaurius, specifically any installation using version 1.3.4 or earlier. No other products or versions are reported affected.

The CVSS score of 8.5 indicates a high severity impact. The EPSS score of less than 1% suggests that, although the vulnerability exists, the likelihood of exploitation in the wild is currently low. The issue is not listed in CISA’s KEV catalog. The likely attack vector is a web request to the plugin’s input interface, where an attacker can inject malicious SQL code into parameters handled by the plugin.