WPVibes AnyWhere Elementor plugin versions up to 1.3.0 contain an improper neutralization of special elements used in an SQL command, allowing a blind SQL injection attack that can exfiltrate sensitive data from the database. The flaw arises from unsanitized input incorporated directly into SQL queries, which means an attacker can read or modify database content without authentication. This vulnerability can compromise the confidentiality and integrity of site data, potentially exposing user information, site configuration, and other critical information.

The affected product is the WordPress AnyWhere Elementor plugin from WPVibes, with all releases from the initial version through version 1.3.0 vulnerable. Any site running any of these versions is at risk.

The CVSS score of 8.5 indicates a high severity. The EPSS score is not available, so exact exploitation probability is unknown, but the lack of a KEV listing suggests it is not currently a widely used exploit. The likely attack vector is via web requests that provide unsanitized input, possibly through a UI element or API endpoint. An attacker who can send crafted requests to the plugin endpoint can perform a blind SQL injection to read or modify data. While the vulnerability is non‑authenticated, it requires the attacker to identify the vulnerable parameter and engineer a payload, which may be non-trivial but is feasible with automated tools.