The vulnerable parameter is named 'description' and appears in both user profile editing pages. Because the plugin concatenates this value directly into a MySQL query without applying proper escaping or using prepared statements, an attacker who is logged in as a Subscriber or higher can inject arbitrary SQL fragments. Exploitation enables the attacker to append additional SELECT statements that extract sensitive database data, such as user credentials or site configuration. The vulnerability only surfaces when the attacker defers the attack to an administrator who subsequently performs the plugin’s standard export or restore operation, making the successful data exfiltration contingent on a second party’s action.

The WebToffee WP Backup and Migration plugin for WordPress is affected in all releases up to and including version 1.6.1. No other product or vendor is listed as impacted.

The CVSS score of 5.7 indicates moderate severity. Exploit probability calculations (EPSS) are not available, and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. Attackers need authenticated subscriber-level access to inject code, and a separate administrator must then trigger the export/import operation for the injection to execute, limiting the attack vector to environments where such role collaboration is possible. While not a high‑risk flaw, the combination of user privilege escalation and data exfiltration warrants timely remediation.