The vulnerability arises from improper neutralization of special elements used in an SQL command within the Media Library Tools plugin. An attacker can inject malicious SQL through user-supplied input, leading to unauthorized read, update, or delete operations in the database. The weakness corresponds to CWE-89 and can compromise both confidentiality and integrity of the WordPress site's data.

The affected vendor is Tiny Solutions and the product is Media Library Tools, all releases up to and including version 1.6.15 are impacted.

The CVSS score of 7.6 indicates high severity, but the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit it via a crafted HTTP request to the plugin’s endpoint, inserting malicious SQL into a parameter that the plugin fails to sanitize.