Blappsta Mobile App Plugin, a WordPress add‑on for iPhone and Android, contains an unchecked SQL Injection flaw in the nh_ynaa_comments() function. Unsanitized user input is concatenated into a database query without proper escaping or prepared statements, enabling any visitor to inject SQL code. Successful exploitation allows attackers to append or replace statements in the existing query, thereby exfiltrating rows from the database, potentially exposing user credentials, content, or proprietary data. The vulnerability is classified as CWE-89 and results in a high severity CVSS score of 7.5.

This vulnerability affects the Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App for WordPress, versions up to and including 0.8.8.8. The plugin is identified under the nebelhorn:Blappsta Mobile App Plugin product line and is distributed via the WordPress plugin repository. Any WordPress site that has installed the plugin before the release of 0.8.8.9 (or a later fixed version) is susceptible to the flaw.

The CVSS score of 7.5 denotes a high‑severity vulnerability with significant impact. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present, and the issue has not been listed in CISA’s KEV catalog. However, the flaw allows unauthenticated SQL injection through the plugin’s exposed endpoint; the likely attack vector involves sending a crafted HTTP request that injects SQL code into the nh_ynaa_comments() function, enabling the attacker to read sensitive data from the database and potentially compromise confidentiality and integrity of the affected site.