The vulnerability is an unsanitized input that allows attackers to inject arbitrary SQL commands through the AnyComment plugin. This flaw can result in unauthorized data retrieval, alteration, or deletion; in extreme cases, it could lead to full database takeover. It reflects the classic CWE‑89 injection weakness that erodes data confidentiality and integrity.

All WordPress sites that run the Alexander AnyComment plugin version 0.3.6 or earlier are affected. The plugin is integrated as a component of WordPress and is listed under the vendor name Alexander.

The CVSS score of 8.5 indicates high severity, while the EPSS score of <1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not present in the CISA KEV catalog, so no confirmed active exploitation has been reported. Based on the description, the attack vector is inferred to be remote, via web requests targeting the plugin’s exposed endpoints. Successful exploitation could enable broader system compromise if database credentials are weak.