The vulnerability is an improper neutralization of special characters used in an SQL command, which allows an attacker to inject arbitrary SQL code via the CountDown With Image or Video Background plugin’s input mechanisms. This flaw is classified as a blind SQL injection, meaning the attacker may not receive immediate feedback but can still infer data or perform destructive operations such as data exfiltration, modification, or deletion, undermining both the confidentiality and integrity of the site’s database.

The issue affects the LambertGroup CountDown With Image or Video Background WordPress plugin on all versions from the initial release through version 1.5. WordPress sites that have this plugin installed and enabled, regardless of their WordPress core version, are susceptible.

The CVSS score of 8.5 places this vulnerability in the high severity range. While the EPSS score is below 1 percent, suggesting rare exploitation, the lack of any known public exploits and its exclusion from the CISA KEV catalog means that active attacks are unlikely as of this assessment. The attack surface is primarily the plugin’s exposed form fields, and an attacker would need access to a user interface that can submit crafted input or otherwise interact with those fields.