Improper neutralization of special elements in an SQL command in the Wolmart Core plugin introduces a blind SQL injection flaw. The vulnerability can be exploited by supplying crafted input to the plugin, allowing an attacker to infer information from the database through response analysis. This capability may lead to data compromise, as sensitive information can be disclosed. The weakness is classified as CWE‑89.

The WordPress Wolmart Core plugin from don‑themes is vulnerable in all releases up to and including version 1.9.6. Users who run any of these versions on a WordPress site are at risk, particularly when the plugin’s endpoints are reachable from the internet.

The CVSS base score of 9.3 indicates a critical severity. An EPSS score of <1% suggests a low but nonzero likelihood of exploitation at the time of analysis, and the flaw is not listed in the CISA KEV catalog. While the CVE description does not specify an attack vector, it is inferred that an attacker can initiate the injection remotely through HTTP requests to the plugin’s input points without needing authenticated access. Consequently, sites exposing the vulnerable plugin to external traffic face a substantial risk of data extraction.