The vulnerability originates from insufficient neutralization of user input when the Electio Core plugin constructs SQL statements. Classified as CWE‑89, the flaw permits attackers to inject arbitrary SQL code. The reported impact is a Blind SQL Injection that enables an observer to extract data from the WordPress database, thereby compromising the confidentiality and integrity of site data.

The defect affects the TeconceTheme Electio Core plugin, version 1.4 and earlier. All WordPress sites that have this plugin installed—regardless of the WordPress core version—are exposed to the injection risk.

The CVSS score of 9.3 indicates a high severity assessment. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog. The description states the presence of a Blind SQL Injection but does not disclose whether authentication or a public endpoint is required to reach the vulnerable code; therefore the exact attack surface cannot be determined from the supplied data. If the injection can be triggered via a public web request, the risk is that an unauthenticated user could gather sensitive information from the database.