The Wp cycle text announcement plugin is vulnerable to SQL Injection when a user supplies a crafted 'cycle-text' shortcode. Because user input is not properly escaped and the plugin does not use parameterized queries, an attacker can append arbitrary SQL statements that are executed by the database. This flaw enables the unauthorized extraction of sensitive data from the WordPress database, exposing confidential information to anyone who gains sufficient access. The likely attack vector involves an authenticated contributor embedding a malicious 'cycle-text' shortcode, which is inferred from the description and typical WordPress plugin usage.

The vulnerability affects the gopi_plus Wp cycle text announcement plugin in all versions up to and including 8.1. Administrators and developers should verify that their sites are running a patched release (8.2 or newer) and that any older installations are promptly updated.

The CVSS score of 6.5 signals a medium severity impact, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the present time. The flaw is not listed in the CISA KEV catalog, suggesting no large‑scale exploitation has been detected. Exploitation requires authenticated Contributor‑level access or higher, and the attacker must be able to embed a malicious shortcode, which limits the attack surface to sites that expose the 'cycle-text' functionality to contributors. It is inferred that the attacker would need a Contributor or higher role with access to edit shortcodes, as the description specifies authenticated attacks are required.