The Swift Performance Lite WordPress plugin prior to version 2.3.7.4 fails to properly sanitize and escape a value before it is used in a SQL statement. This flaw can be exploited by users with the author role or higher to inject arbitrary SQL commands. An attacker could thereby manipulate the database, read sensitive data, or alter site content, potentially leading to data loss or site compromise.

WordPress installations running Swift Performance Lite plugin versions earlier than 2.3.7.4 are affected. The vulnerability exists in the image optimizer component of the plugin.

The CVSS score of 6.8 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. The flaw requires the attacker to have author role or higher, and the likely attack vector is a remote HTTP request to the image optimizer endpoint that accepts user input and uses it in a SQL statement without adequate sanitization.