The Allmart plugin for WordPress contains an improper neutralization of special elements in SQL commands, allowing a blind SQL injection flaw. This weakness is defined as CWE‑89 and enables an attacker to embed malicious SQL fragments into database queries processed by the plugin. The potential impact includes unauthorized read or modification of the database, which can lead to data disclosure, corruption, or further compromise of the WordPress installation.

TeconceTheme Allmart Allmart‑core for WordPress is affected. Every installation that has a version number of 1.1 or earlier is vulnerable; versions newer than 1.1 are not listed as affected in the CVE description.

The vulnerability receives a CVSS score of 9.3, indicating critical severity. The EPSS score is below 1%, suggesting a very low but non‑zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. It is inferred that the attack vector is remote, requiring an attacker to supply crafted input via HTTP requests to the plugin’s endpoints. Successful exploitation would allow the attacker to perform blind SQL queries against the underlying database.