The vulnerability is a classic SQL Injection flaw (CWE‑89) that occurs when the PostaPanduri WordPress plugin fails to neutralize special characters used in SQL commands. An attacker can craft input that is interpreted as part of an SQL query, allowing extraction or manipulation of database contents. This results in a loss of confidentiality and potential data tampering.

The flaw affects the PostaPanduri plugin for WordPress developed by Adrian Ladó, specifically all releases from the first version through 2.1.3. No later versions are known to be impacted.

The CVSS score of 9.3 indicates the vulnerability is critical. Its EPSS score of less than 1% suggests that, at the moment, active exploitation is unlikely, but the high severity and lack of a CISA KEV listing mean that attackers could still exploit the flaw if they find a vulnerable site. The attack vector is inferred to be through any web request that sends user‑controlled data to the plugin’s SQL handling code, likely via a form or API endpoint. An attacker would need network access to the affected WordPress installation and does not require any privileged credentials to exploit the injection.