The vulnerability is an improper neutralization of special elements in an SQL command, allowing attackers to inject arbitrary SQL. This could let an attacker read, modify, or delete data stored in the WordPress database, compromising confidentiality, integrity, and availability. The weakness is a classic input validation flaw classified as CWE-89.

The issue affects the Proxymis Interview plugin for WordPress version 1.01 and earlier. Any WordPress site using this plugin is at risk until it is removed or updated.

With a CVSS score of 8.5 the flaw is considered high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Based on the description the likely attack vector is through the web interface of the plugin, where unsanitized input is passed to SQL statements. No authentication is required if the plugin exposes functions to standard users, making it potentially exploitable by anyone able to submit data to the plugin.