The vulnerability is an SQL injection flaw caused by improper handling of user-supplied input in the Multi CryptoCurrency Payments plugin for WordPress. An attacker can supply crafted data that is concatenated into a database query, allowing arbitrary SQL execution. The result can be reading, modifying, or deleting critical data, compromising the confidentiality, integrity, and availability of the site and its underlying database.

The affected product is Alex Zaytseff's Multi CryptoCurrency Payments plugin, all releases from the initial version up to and including 2.0.7. No specific patch version is listed; the issue exists in any installation of the plugin with a version less than or equal to 2.0.7. No other products or vendor versions were mentioned.

The CVSS rating of 9.3 categorises this as a critical flaw. Although the EPSS score is below 1%, indicating a low current exploitation probability, the severity warrants immediate attention. The plugin is publicly available on WordPress installations, so the most likely attack vector is remote exploitation via the plugin’s public-facing API or form endpoint. It is not listed in CISA’s KEV catalog, but the high impact score suggests that adversaries may still target it.