The WordPress plugin Custom 404 Pro contains a time‑based SQL injection flaw in the path parameter used by administrative helpers. The value is not sanitized and is incorporated directly into an SQL statement that is not prepared. This allows an attacker who is already authenticated with Administrator level or higher to append additional SQL queries, potentially extracting sensitive data from the database.

Custom 404 Pro plugin for WordPress, all releases up to and including version 3.12.0. No other products are affected according to the vendor information.

The CVSS score is 4.9, reflecting medium severity for data confidentiality impact. The EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because an attacker must first be authenticated with Administrator privileges, the attack surface is limited to trusted users. The time‑based nature of the injection could also be detected through response latency, further reducing the practical exploitation risk.