The Paid Downloads plugin for WordPress contains an improper neutralization of special elements used in an SQL command, leading to a blind SQL injection vulnerability. Because the plugin does not validate or escape user‑supplied input in its database queries, an attacker can craft requests that result in the execution of arbitrary SQL. This flaw enables the attacker to read sensitive data from the database or modify database contents, potentially leading to a data breach. The severity is reflected by a high CVSS score of 9.3.

All installations of the Paid Downloads plugin by ichurakov with version 3.15 or earlier. The impact applies to any WordPress site running these unsupported plugin versions.

The CVSS score of 9.3 indicates a critical severity. While the EPSS score is less than 1%—suggesting a low probability of current exploitation—the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via the web application layer, where an attacker submits a crafted payload through the plugin’s interface. Successful exploitation allows the attacker to extract sensitive data or alter database contents, which could compromise the confidentiality of the site’s data.