The vulnerability arises from improper neutralization of special elements in an SQL command within the TeconceTheme Woodly Core plugin. It permits blind SQL injection that can enable an attacker to extract sensitive database information, potentially exposing user credentials, content, and site configuration. The flaw is a classic SQL Injection weakness identified as CWE-89.

WordPress sites that have installed the Woodly Core plugin version 1.4 or earlier. The affected product is the Woodly Core plugin from TeconceTheme, integrated into the WordPress environment.

The CVSS score of 9.3 marks the issue as critical, indicating the ability to compromise data confidentiality and integrity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers would likely exploit publicly accessible plugin endpoints, crafting input that triggers the blind SQL injection remotely via the web interface.