This vulnerability is an improper neutralization of special elements in SQL commands, known as a blind SQL Injection. The flaw resides in the ProfileGrid plugin for WordPress, where user‑supplied data is incorporated into database queries without proper parameterization. Because the injection is blind, an attacker can deduce information from error or timing responses, and can also perform destructive actions such as modifying or deleting records. The issue is formally categorized as CWE‑89 and can lead to confidentiality, integrity, and availability impacts on the underlying database. Affected systems include any WordPress installation running the Metagauss ProfileGrid plugin up to and including version 5.9.5.3. Software and other WordPress components are unaffected; the attack vector requires that the vulnerable plugin be installed and publicly reachable. Sites that process user input through the plugin are at risk, while those that have removed or disabled the plugin no longer expose this code path. The risk is rated moderate to high. The CVSS score of 8.5 reflects the serious potential impact if an attacker succeeds. The EPSS score of less than 1% indicates that, as of the latest data, real‑world exploitation is uncommon, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw can be triggered via simple HTTP requests and does not require privileged server access, it remains a high‑priority concern for site administrators.

Affected systems include any WordPress installation running the Metagauss ProfileGrid plugin up to and including version 5.9.5.3. Software and other WordPress components are unaffected; the attack vector requires that the vulnerable plugin be installed and publicly reachable. Sites that process user input through the plugin are at risk, while those that have removed or disabled the plugin no longer expose this code path.

The risk is moderate to high. The CVSS score of 8.5 indicates a serious potential for confidentiality, integrity, and availability impact. The EPSS score of less than 1% suggests that real‑world exploitation is uncommon, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw can be triggered via simple HTTP requests without privileged server access, making it a high‑priority concern for site administrators.