The vulnerability is a classic SQL injection flaw caused by improper neutralization of special elements in an SQL command within the Mang Board WP plugin. This flaw allows an attacker to craft malicious input that will be directly incorporated into database queries, enabling arbitrary SQL code execution. If successfully exploited, an attacker could read, modify, or delete data stored in the WordPress database, potentially compromising user information, site integrity, or even enabling further attacks.

The affected product is the Mang Board WP plugin developed by Kitae Park. Versions from the initial release through 2.4.4 are vulnerable. WordPress sites that have installed any of these plugin versions and that expose the plugin's input interfaces are potentially affected.

The CVSS score of 9.3 indicates a high severity flaw. The EPSS score of less than 1 % suggests that the exploitation probability is low, but the vulnerability is listed in the CWE-89 set. Because the plugin runs within the web application, the likely attack vector is remote, through crafted HTTP requests to the plugin's input endpoints. Exploitation would require the attacker to supply specially constructed input that bypasses the plugin's sanitization, leading to execution of arbitrary SQL against the MySQL database used by WordPress. If the WordPress database user has broad permissions, this could result in full database compromise.