The Library Management System WordPress plugin before 3.5.8 fails to sanitize or escape the user‑supplied book_id parameter before using it in a SQL statement. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, producing full data exfiltration of database contents, including user password hashes. The vulnerability is a classic injected flaw that directly compromises the confidentiality and integrity of all data stored by the plugin, with potential for complete database compromise if left unchecked.

All WordPress sites that have the Library Management System plugin installed with a version older than 3.5.8 are affected. The plugin is deployed on sites offering library or book catalog functions and is typically exposed to the Internet, so any site with the plugin active and the book_id endpoint reachable is vulnerable, irrespective of user authentication.

The exploitation path is remote and unauthenticated, requiring only an HTTP request containing a crafted book_id value to a public endpoint. The CVSS score of 8.6 signifies a high severity, and the EPSS score of less than 1% indicates low current exploitation probability, though the absence of a CISA KEV listing does not reduce the risk. Based on the description, the likely attack vector is a direct HTTP request, allowing automated exploitation without privilege escalation.