The vulnerability is a classic SQL Injection flaw (Improper Neutralization of Special Elements used in an SQL Command) that allows attackers to inject arbitrary SQL statements through unsanitized inputs in the Hover Effects plugin, potentially leading to data disclosure and unauthorized modification of database records depending on the privileges of the database user that executes the queries.

The flaw affects the Wow‑Company Hover Effects WordPress plugin, specifically versions n/a through 2.1.2. No other versions are listed as affected.

The CVSS score of 7.6 categorizes the issue as high severity, indicating significant impact if exploited. The EPSS score is less than 1%, implying a very low probability of real‑world exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of active exploitation yet. The likely attack vector appears to be a web‑based injection via the plugin’s input fields exposed by the Hover Effects plugin; it is not explicitly stated whether authentication is required, so this is inferred. The extent of impact would depend on the database user privileges.