The RealMag777 MDTF WordPress plugin is vulnerable because it fails to properly neutralize special characters used in SQL commands. This flaw allows an attacker to inject arbitrary SQL statements through the plugin’s input fields, enabling them to read, modify, or delete contents from the WordPress database. Such an attack can result in significant confidentiality and integrity violations, including the theft of user data, credential leakage, or complete site compromise.

WordPress sites that have installed the RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter plugin, version 1.3.3.7 or earlier, are affected. The vulnerability applies to all releases through and including 1.3.3.7.

The CVSS score of 9.3 indicates a high‑severity flaw. The EPSS score of less than 1 % suggests that, so far, exploitation attempts may be infrequent, yet the potential impact remains substantial. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, accessed via the web interface; an attacker only needs to supply malicious input to the plugin’s data‑filter endpoints to achieve the exploit. Because the flaw can manipulate database content, it poses a serious risk of data loss, corruption, or unauthorized disclosure.