The Gestion de tarifs plugin for WordPress is vulnerable to SQL injection through the 'tarif' and 'intitule' shortcodes in all versions up to 1.4. The lack of proper escaping and query preparation allows authenticated users with Contributor or higher privileges to append malicious SQL statements to existing queries, potentially retrieving sensitive data from the database. This flaw is a classic injection vulnerability classified under CWE-89.

This vulnerability affects the evigeo Gestion de tarifs WordPress plugin, specifically any installation using version 1.4 or earlier. Sites running these plugin versions are therefore susceptible when users with Contributor role or higher are present.

The CVSS score is 6.5, indicating a medium severity, while the EPSS score of less than 1% signals a low probability of exploitation in the wild. The flaw requires authenticated access, so an attacker must already have a Contributor or higher level account on the target WordPress site. The attack can be carried out by sending crafted shortcode parameters to trigger the injection, but the limited exposure to privileged users and the absence of a public exploit reduce the overall risk. The vulnerability is not listed in the CISA KEV catalog, though it remains a significant internal threat for sites using the affected plugin version.