The vulnerability stems from inadequate sanitization of the sc parameter in the Quotes llama WordPress plugin before 3.1.6, allowing crafted input that is inserted into a SQL query, enabling UNION-based injection. This flaw lets a unauthenticated user retrieve data stored in the database, including password hashes and other sensitive information. The weakness is a classic input validation flaw, identified as CWE‑89, with the potential to compromise confidentiality and credential integrity for the affected site. The plugin’s failure to guard against injection results in an attacker having read access to arbitrary database tables and potentially using extracted hashes for credential stuffing or other attacks.

WordPress sites running the Quotes llama plugin older than version 3.1.6 are affected. Signatures or references specifically mention the sc parameter that can be exploited without authentication. No other products or versions are indicated as impacted.

The CVSS score of 8.6 highlights a high severity flaw, while the EPSS score of less than 1% suggests a low current exploitation probability, yet the attack CISA KEV catalog, indicating no known widespread exploitation. Given that the flaw allows unauthenticated attackers with network visibility to the WordPress site to construct payloads, the likely attack vector is remote web-based exploitation (the inference is made based on the description that the vulnerability is accessed via a web parameter). Potential attackers that exfiltrate database content, leading to credential compromise and subsequent account takeover.