The CleverReach WP plugin contains an SQL injection flaw caused by improper neutralization of special characters in SQL statements (CWE‑89). An attacker who can send crafted input to the vulnerable plugin endpoints can inject arbitrary SQL, potentially reading, modifying, or deleting data from the WordPress database. This compromise could expose sensitive content, disrupt site functionality, and undermine data integrity.

Any WordPress site running the CleverReach WP plugin version 1.5.21 or earlier is affected. The vulnerability applies regardless of the underlying operating system or WordPress core version, as the flaw exists in the plugin code itself.

The CVSS score of 9.3 classifies the issue as critical. The EPSS score of < 1 % indicates that active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is crafted HTTP requests to the plugin’s input endpoints; this can be achieved by any user who can send requests to the site, though no additional authentication or privilege is required beyond this capability. The impact spans the entire database of the affected WordPress installation.