Improper neutralization of special elements in the SQL command creates an injection point that lets an attacker insert arbitrary SQL code when interacting with the Agile Logix Store Locator WordPress plugin. The flaw can allow unauthorized disclosure, modification, or deletion of database records and may lead to further privilege escalation if the database user has elevated rights. The weakness is classified as CWE‑89.

Any WordPress installation that has the Agile Logix Store Locator WordPress plugin version 1.5.1 or earlier is affected. The CVE does not confirm that newer releases (e.g., 1.5.2) include a fix, so administrators should verify whether an updated version addresses the issue.

The CVSS score of 7.6 indicates high severity, and the EPSS score of less than 1% suggests that exploit attempts are currently uncommon. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been documented as a known exploited incident. Attackers would typically trigger the flaw via crafted HTTP requests to the plugin’s data handling endpoints; it appears that authentication is not required, but this is inferred from the description, indicating a public attack surface.