The vulnerability is an improper neutralization of special elements used in SQL commands, allowing attackers to inject arbitrary SQL statements through the Pakke Envíos WordPress plugin. This flaw enables attackers to read, modify, or delete data in the database, potentially compromising confidentiality, integrity, and availability of the site’s data. The weakness is identified as CWE-89, a classic parameter injection flaw.

The affected product is the WordPress Pakke Envíos plugin released by pakkemx. Versions from the earliest released versions up to and including 1.0.2 are impacted. Any WordPress site that has installed Pakke Envíos 1.0.2 or earlier is at risk.

The CVSS score of 8.5 places this flaw in the high severity range. The EPSS score is below 1%, indicating that, at present, the probability of exploitation is low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the plugin and typical WordPress usage, the plausible attack vector is remote, via crafted HTTP requests to the plugin’s endpoints. An attacker would need to supply malicious input in a request that the plugin passes directly to the database without proper sanitization or parameterization.