The Nest Addons plugin allows an attacker to inject arbitrary SQL commands by failing to neutralize special elements in user input, a classic SQL injection flaw identified as CWE‑89. This vulnerability can enable an attacker to read, modify, or delete data in the WordPress database, severely compromising confidentiality, integrity, and potentially availability if destructive queries are executed. The recorded CVSS score of 9.3 signals a critical risk level.

All installations of the SteelThemes Nest Addons WordPress plugin with a version of 1.6.3 or earlier are affected. The vulnerability originates in the plugin itself rather than the core WordPress framework.

Although the EPSS score of less than 1% indicates a low probability of exploitation at the moment, the high CVSS score and lack of a KEV listing mean that an attacker who can reach the vulnerable plugin could successfully inject SQL. The likely attack path involves manipulating form fields or API requests handled by the plugin, where unsanitized user input is directly concatenated into SQL statements.