The WPMart Team Member plugin suffers from an input validation flaw that allows an attacker to inject SQL statements into the database. A blind SQL injection vulnerability can be leveraged to extract sensitive information from the database, thereby compromising the confidentiality of data stored by the WordPress site.

Any site running the WordPress Team Member plugin, versions up through 8.5, is affected. The plugin is distributed by WPMart and is commonly installed on WordPress sites to manage team member profiles.

The vulnerability carries a CVSS score of 7.6, indicating a high risk. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, but the lack of readily disclosed exploitation evidence does not reduce the potential impact. Because the flaw occurs in a blind SQL injection scenario, it likely requires an attacker to interact with a vulnerable parameter—typically through plugin configuration or form input—without necessarily possessing advanced privileges. The attack vector, therefore, is inferred to be a local or authenticated user level interaction with the plugin’s input fields.