The Store Locator WordPress plugin from Agile Logix contains an improper neutralization of special elements in an SQL command. This flaw, identified as CWE-89, allows an attacker to insert malicious SQL statements that are executed by the database. The affected logic enables blind SQL injection, meaning an attacker can infer data or manipulate records without receiving explicit error messages. This could compromise database confidentiality and integrity, potentially exposing sensitive user data or altering application configuration.

Agile Logix’s Store Locator WordPress plugin, version 1.6.2 and earlier. The problematic code exists in all releases from the earliest available version up to and including 1.6.2.

The severity of the flaw is high, with a CVSS score of 8.5. The EPSS indicates a very low exploitation probability (<1%), and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be via unauthenticated or minimally authenticated HTTP requests to the plugin’s exposed endpoints, allowing an attacker to submit crafted payloads that are incorporated directly into SQL queries.