The vulnerability is an SQL injection flaw caused by improper neutralization of special elements used in an SQL command. An attacker can input crafted data that bypasses normal sanitization, allowing execution of arbitrary SQL statements. The impact includes potential data theft, data modification or deletion, and in some cases, full compromise of the database if privileges are high enough. The weakness is a classic injection flaw classified as CWE-89.

The affected component is the YayCommerce YayExtra WordPress plugin, versions from the earliest release through 1.5.5 inclusive. Any WordPress site that has this plugin installed within the specified version range is at risk.

The CVSS score of 7.6 indicates a high severity vulnerability. The EPSS score of less than 1% shows a very low, but non-zero, probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as an attacker only needs to supply malicious input through web forms or queries that the plugin processes. Based on the description, it is inferred that no additional authentication is required beyond general WordPress user access, making the flaw exploitable by any visitor able to interact with the plugin’s input points.