The PGS Core plugin contains an SQL injection flaw that allows an attacker to execute arbitrary SQL queries by sending crafted input to the plugin’s database queries. This flaw arises from improper neutralization of special characters in user‑controllable data. The vulnerability can lead to disclosure of sensitive data, modification of stored information, or even deletion of database contents. The weakness is classified as CWE‑89. The CVSS score of 8.5 highlights its potential for serious impact.

The vulnerability affects the WordPress PGS Core plugin from Potenzaglobalsolutions, in all versions from the earliest available up to and including 5.9.0. Any WordPress site that has the plugin installed in these releases is vulnerable.

The CVSS score of 8.5 marks this issue as high severity. With an EPSS lower than 1 %, the likelihood of current exploitation remains low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to interact with the plugin’s input parameters, which are likely restricted to users with administrative or plugin‑management rights. Because the description does not state that unauthenticated users can trigger the flaw, it is inferred that privileged access is required, but the risk of compromise for sites with high‑level users remains significant.