The User Feedback plugin contains an SQL Injection vulnerability caused by improper neutralization of special characters in an SQL command. A malicious actor can send crafted input that results in blind SQL injection, allowing them to execute arbitrary SQL queries through the plugin’s interface. This can lead to unauthorized data disclosure, modification, or deletion within the WordPress database, potentially compromising site integrity and confidentiality.

The vulnerability affects the WordPress User Feedback plugin from Syed Balkhi. All installations using version 1.10.0 or earlier are impacted.

The CVSS score of 7.6 indicates a high severity with potential for significant impact if exploited. EPSS suggests a low likelihood of current exploitation (<1%), and the flaw is not listed in the CISA KEV catalog. The attack vector is likely through web traffic to the plugin’s data entry points, where user-supplied input is used without proper sanitization. Although exploitation is presently rare, the effect could be serious if an attacker entices users or if automated attacks succeed.