The vulnerability is an improper neutralization of special elements in a SQL command, which enables a blind SQL injection through the WOLF bulk-editor plugin. An attacker could construct malicious queries that read or modify data in the database, potentially exposing sensitive information or altering site content. The absence of immediate error feedback means exploitation may be silent but still harmful.

PluginUs.Net’s WOLF bulk-editor component is affected for all releases up through 1.1.1. Users running those installed versions are vulnerable; newer releases begin with 1.1.2.

The CVSS score of 7.6 indicates a high severity, and the EPSS score is not available, but the issue is not listed in CISA KEV. The likely attack vector is via the WordPress admin interface that loads the bulk-editor functionality; the exploitation requires constructing a specially crafted request to the vulnerable endpoint. Because it is a blind data extraction technique, a threat actor only needs read access to the database. The risk remains significant until the plugin is updated or removed.