The AutomatorWP plugin for WordPress contains an improper neutralization of special elements in an SQL command, creating a blind SQL injection vulnerability identified as CWE‑89. An attacker controlling the vulnerable input can retrieve sensitive data from the database, potentially exposing credentials, configuration details, or other confidential information. The exploit does not produce immediate code execution but can lead to data compromise and subsequent attacks if further access paths are discovered.

WordPress sites that have the AutomatorWP plugin installed, including all releases from the initial release up to and including version 5.2.1.3 crafted by Ruben Garcia.

The CVSS score of 7.6 indicates a high severity threat. The EPSS score of less than 1 % suggests that, so far, the likelihood of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to stem from plugin interactions, possibly via administrative configuration or function calls; authentication or network exposure prerequisites are not detailed in the description.