The vulnerability arises from improper neutralization of special elements used in an SQL command, classified as a SQL injection flaw. An attacker who can submit crafted input through the LMS theme could inject arbitrary SQL statements into the database. This allows the attacker to read, modify, delete, or exfiltrate sensitive data, including user credentials, course content, and payment information, thereby compromising confidentiality, integrity, and potentially availability if disruptive queries are executed.

The flaw affects the DesignThemes LMS WordPress theme, all installations running versions up to and including 9.2. Sites that have deployed this theme and have not yet applied a later version are potentially impacted.

The CVSS score of 9.3 reflects a high severity, and the EPSS value of < 1% suggests that while exploitation is not common, the vulnerability remains actionable. It is not listed in the CISA KEV catalog. The likely attack vector is remote, via crafted HTTP requests to the Wordpress site that process LMS input. Successful exploitation requires that the attacker can reach a form or endpoint that incorporates unsanitized user input into a database query.