The vulnerability is an instance of Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). An attacker can inject arbitrary SQL code into the plugin’s input handling, potentially reading, modifying, or deleting database contents. The impact is the compromise of confidentiality, integrity, and availability of the site’s data, resulting in data exfiltration or site compromise.

The issue affects the Ruben Garcia AutomatorWP WordPress plugin. All installations using versions n/a through 5.2.4 are vulnerable. No other versions are known to be affected.

The CVSS score of 7.6 indicates a high severity. The EPSS score < 1% suggests a low probability of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s web interface, where an attacker may supply malicious payloads without requiring authentication. If the site’s WordPress instance is publicly accessible, the vulnerability can be exploited remotely. The risk is elevated for sites with significant sensitive data stored in the WordPress database.