Improper neutralization of special elements in SQL commands within the Exertio Framework plugin gives an attacker blind SQL Injection. The vulnerability allows the attacker to craft inputs that are directly embedded into database queries, potentially enabling unauthorized data extraction, modification, or deletion, thereby compromising confidentiality and integrity of the database.

WordPress sites that have the Exertio Framework plugin installed on version 1.3.3 or earlier. All users managing those sites are at risk, regardless of the plugin’s role within the site’s functionality.

The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% suggests that the likelihood of exploitation is very low at present, and the vulnerability is not cataloged in CISA’s KEV list. The attack vector is inferred to be web‑based, requiring the attacker to send specially crafted requests to the plugin’s endpoints. Successful exploitation would confine the attacker to the scope of the web application and the database credentials used by WordPress, but could still lead to significant data exposure if the attacker can leverage the blind injection to infer database structure and contents.