The Unicamp theme for WordPress versions 2.2.2 and earlier contains a flaw that does not sanitize data used in SQL statements that store subscriber information. This omission results in a SQL Injection vulnerability (CWE‑89), enabling an attacker to inject arbitrary SQL commands that can read, modify, or delete database records, thereby compromising confidentiality, integrity, and availability of the site’s data.

Any WordPress site that theme version 2.2.2 or older, distributed by ThemeMove, is affected. Sites must check the theme version and upgrade when possible; no other WordPress themes are impacted.

The CVSS score of 8.5 The EPSS score of less than 1% suggests a low current exploitation probability and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote, with an attacker sending a crafted request to the subscription endpoint; successful exploitation requires the lack of proper input escaping or the absence of prepared statements.