The vulnerability arises because the Project Management, Bug and Issue Tracking Plugin accepts user-supplied search input, combines it directly into an SQL query, and fails to escape or sanitize it. This omission allows an unauthenticated attacker to inject arbitrary SQL statements via the search parameter. Based on the description, it is inferred that a successful injection could grant the attacker the ability to read, modify, or delete database records, thereby compromising both confidentiality and integrity of the site’s data.

The affected product is the WordPress plugin Project Management, Bug and Issue Tracking Plugin, versions prior to 5.1.0, especially 5.0.x. Sites that run these versions usually host public issue trackers and expose the plugin’s standard front‑end search interface to anyone who can access the site’s URL. The vulnerable search endpoint is reachable without authentication, making the attack surface obvious to remote users.

The CVSS score of 9.1 indicates critical severity, and the EPSS score of less than 1 % suggests a currently low likelihood of widespread exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the plugin’s exposed search endpoint with a browser or automated script, providing a crafted payload in the search field. Successful exploitation would allow reading, alteration, or deletion of database contents, thus posing a significant risk to sites that rely on the plugin for issue tracking.