The vulnerability is an SQL injection caused by improper neutralization of special elements, allowing an attacker to craft and execute arbitrary SQL statements against the WordPress database. This flaw permits disclosure, modification, or deletion of sensitive data and is identified as CWE‑89.

Vendors Metagauss and the ProfileGrid plugin are affected. All releases up to and including version 5.9.5.2 are susceptible; versions newer than 5.9.5.2 are not known to contain the flaw.

The CVSS score of 8.5 indicates that the vulnerability is high in severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, achievable via malicious input submitted through the plugin’s web interface. No explicit authentication requirement is mentioned, implying that users with minimal access or unauthenticated attackers could exploit the flaw.