This vulnerability is caused by improper neutralization of special characters that are subsequently incorporated into SQL commands in the ClickandPledge WordPress‑WPJobBoard plugin. The flaw allows an attacker to inject arbitrary SQL statements into a query, resulting in blind SQL injection. Consequently, an attacker could retrieve sensitive data from the database or modify existing records, thereby compromising the confidentiality and integrity of stored information. The weakness corresponds to CWE‑89 and the CVE data indicates it is a blind injection scenario.

The affected component is the WordPress‑WPJobBoard plugin for WordPress, produced by ClickandPledge. All plugin releases up to and including version 25.07010000‑WP6.8.1‑JB5.11.5 are vulnerable; earlier releases are also likely affected because the issue is listed as "from n/a through <=". No newer releases have been specified as patched in the current data.

The CVSS base score of 9.3 rates the issue as critical. The EPSS score of less than 1% indicates a very low probability of observed exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be web‑based, where a crafted HTTP request to the plugin’s parameter‑handling endpoint can trigger the injection. No elevated privileges or additional prerequisites are mentioned, implying that any standard visitor or user with permission to submit data could potentially exploit the flaw. The exploitation results in database read or write operations; no evidence of privilege escalation or remote code execution is provided in the description.