An improper neutralization of special elements in an SQL command in the Crowd Favorite DXP ToolKit WordPress plugin allows attackers to inject arbitrary SQL. The flaw stems from unsanitized input being used directly within a database query, enabling the execution of attacker‑supplied SQL statements. This can lead to data theft, modification, or deletion, and may provide a foothold for further compromise of the site’s data integrity and confidentiality.

The vulnerability exists in the WordPress DXP ToolKit plugin from its earliest release through version 2.0.1. All WordPress sites using any of these plugin versions are affected, regardless of other site configurations. The plugin is distributed by Crowd Favorite as part of the DXP ToolKit suite.

The CVSS score of 9.3 classifies this flaw as critical. Although no EPSS score is available, the lack of a KEV listing does not diminish the high potential for exploitation. The likely attack vector is remote, whereby an attacker sends malicious input to any of the plugin’s endpoints exposed via the WordPress admin interface or public forms. Successful exploitation can allow read, update, or delete operations on the database, potentially giving attackers control over site content and user data.