The vulnerability in ArtPlacer Widget results from improper neutralization of special elements in an SQL command, allowing blind SQL injection as defined by CWE-89. An attacker could craft requests that cause the plugin to execute arbitrary SQL statements, potentially reading, modifying, or deleting database contents. The consequences affect confidentiality and integrity of the site’s data, and because the plugin interacts with the WordPress database, the impact can extend to the entire site’s content and configuration.

WordPress plugins named ArtPlacer Widget, delivered by the vendor ArtPlacer. Versions up through 2.22.9.2 are affected; no later versions are known to contain this flaw.

The assessment shows a CVSS score of 8.5, indicating high severity, yet the EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV, meaning no publicly documented exploits exist. The typical attack vector is remote via the web interface of the affected site, and the inferred path is an attacker submitting specially crafted input through the plugin’s endpoints. Despite the low EPSS, the severity remains high, so the risk warrants prompt patching or mitigation.