The All in one Minifier WordPress plugin contains a flaw that allows a remote attacker to inject arbitrary SQL through the 'post_id' input on the admin-ajax.php endpoint. The plugin fails to escape this parameter and does not use prepared statements, so an attacker can append additional SQL statements and read sensitive database content. This vulnerability maps to CWE‑89 and can be exploited without authentication.

WordPress sites using the All in one Minifier plugin, version 3.2 or earlier, provided by vendor maheshmthorat. Any installation of that plugin up to and including version 3.2 is impacted.

The CVSS score of 7.5 indicates a high severity risk; the EPSS score of less than 1% shows a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. Attackers would need only to send a crafted HTTP request to wp-admin/admin-ajax.php containing a malicious 'post_id' value, which does not require authentication, suggesting a remote attack path via the web interface.