This vulnerability stems from improper neutralization of special characters in an SQL statement within the LBG Zoominoutslider plugin. An attacker can craft input that injects arbitrary SQL commands, potentially gaining unauthorized read or write access to a WordPress site’s database. This could lead to data exposure, corruption, or a full compromise of the site.

WordPress installations that use the LBG Zoominoutslider plugin from LambertGroup and run any version up to and including 5.4.4 are vulnerable. The flaw is removed in later releases such as 5.4.5; no other affected versions are noted.

The CVSS score of 8.5 signals a critical level of severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited or no known exploitation activity. Based on the description, the likely attack vector is a remote unauthenticated HTTP request that targets the plugin’s input handling routine, allowing the injection of arbitrary SQL statements. Successful exploitation would grant attackers full read/write control over the site’s database.