VillaTheme WPBulky plugin has an improper neutralization of special elements in an SQL command, allowing attackers to inject malicious SQL. The vulnerability is a classic blind SQL injection flaw, falling under CWE‑89. By exploiting it, an attacker can read, modify, or delete data in the underlying WordPress database, potentially compromising the confidentiality, integrity, and availability of the site and its content.

The affected product is the WPBulky plugin by VillaTheme, versions from the earliest releases through 1.1.13 inclusive. Any WordPress installation using these plugin versions is susceptible; newer revisions of the plugin are not listed as impacted.

The CVSS score of 7.6 indicates high severity, while the EPSS score of < 1% suggests limited current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Classified as a blind SQL injection, the flaw means attackers cannot rely on immediate error messages; they must infer success through timing or other side‑channel techniques. Based on the description, a successful exploitation could allow an attacker to read, modify, or delete database contents, potentially compromising confidentiality, integrity, and availability of the WordPress site.