The vulnerability is an SQL Injection flaw that allows attackers to inject SQL commands into the plugin’s queries, resulting in a blind SQL injection attack. This weakness can lead to unauthorized retrieval or modification of database contents, thereby compromising the confidentiality and integrity of data stored by the WordPress site.

The flaw exists in the gopiplus Vertical scroll slideshow gallery v2 plugin, affecting all releases from the initial version through 9.1. Characters such as the plugin name and version range are explicitly listed as impacted.

The CVSS score of 8.8 signals a high severity level, while the EPSS score of less than 1% indicates that known exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV, which suggests it has not yet been documented as actively exploited in the field. Exploitation is possible from a web request targeting the plugin’s endpoints, and the attack does not require privileged user access—making it a plausible threat for remote attackers.