This SQL Injection flaw in the Medinik Core plugin allows a blind injection of special elements; the description indicates that the injected commands may be used to retrieve, modify, or delete database content, but it is not explicitly stated that these actions are possible. The likely attack would involve extracting or altering data. The weakness maps to CWE-89 and represents a serious risk to confidentiality, integrity, and availability.

The vulnerability affects the TeconceTheme Medinik Core plugin for WordPress, impacting all releases from the earliest version through version 1.3.6 inclusive.

The CVSS score of 9.3 indicates a very high severity. The EPSS score is below 1%, suggesting that the likelihood of exploitation is currently low, and the flaw is not listed in the CISA KEV catalog. Nevertheless, because the plugin is publicly exposed on WordPress sites, a remote attacker could potentially exploit the blind SQL injection; based on the description it is inferred that this could enable the extraction or alteration of data.