The Testimonial plugin for WordPress contains a SQL injection vulnerability in the iNICtestimonial shortcode. The lack of proper escaping and prepared statements allows an authenticated user with Contributor-level access or higher to inject arbitrary SQL statements. The injected code could read sensitive data stored in the database, such as user credentials, personal information, or other confidential content. This vulnerability is classified as CWE-89.

The vulnerability affects the Testimonial plugin version 2.3 and all earlier releases. These versions are distributed on the WordPress plugin repository and also consumed by users of WordPress sites that have installed the plugin. Any site running an affected version of Testimonial is at risk. The plugin is identified by the vendor "laki_patel" under the product name "Testimonial".

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but still possible, especially in targeted attacks. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access, so a malicious contributor or higher role that has the ability to insert content can exploit the flaw by crafting a malicious value for the shortcode parameter. Once exploited, an attacker could read data from the database by appending additional SELECT statements.