The Library Management System WordPress plugin before version 3.5.8 fails to sanitize or escape the user‑supplied book_id parameter before it is inserted directly into a SQL statement. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands into the query. By exploiting the injection, an attacker can exfiltrate confidential data from the database, including user password hashes, thereby compromising the confidentiality and integrity of all accounts stored by the plugin. The vulnerability is a textbook example of a classic injection flaw that can lead to full database compromise if left unchecked.

All installations of the Library Management System WordPress plugin whose version is less than 3.5.8 are affected. The plugin is commonly deployed by WordPress sites that provide library or book catalog functions. Any site that has the plugin active and exposed to the Internet is vulnerable, regardless of user authentication state.

The exploit path is remote and unauthenticated, requiring only an HTTP request containing a crafted book_id value. No authentication or privilege elevation is necessary, making the vulnerability immediately actionable by any external actor. The CVSS score of 8.6 indicates a high severity with full impact on confidentiality and integrity, and an EPSS score of less than 1% suggests low current exploitation probability. The lack of a CISA KEV listing does not diminish the risk posed by an unchecked SQL injection in a widely used WordPress plugin. Based on the description, the likely attack vector is a direct HTTP request to a URL that processes the book_id parameter, facilitating automated exploitation.