The Dinatur WordPress plugin through version 1.18 fails to escape or validate user input used in an SQL query, enabling unauthenticated attackers to inject malicious SQL code. Additionally, the same request handler performs a database table truncation without any authentication check, giving an attacker the ability to wipe all plugin data. These weaknesses can be exploited to read, modify, or delete data, potentially leading to full compromise of the plugin’s database.

The vulnerability affects the Dinatur WordPress plugin for all releases up to and including version 1.18. Any WordPress instance running the affected plugin is therefore exposed until a newer, patched version is installed.

With a CVSS score of 8.6 the vulnerability is considered high severity, yet the EPSS score indicates that the likelihood of exploitation is currently below 1% and the flaw is not present in CISA’s KEV catalog. Attack likely comes from an unauthenticated user sending a crafted request to the vulnerable endpoint; no prior authentication or special credentials are required. The resulting exploit can lead to unauthorized database read or delete operations, compromising confidentiality and integrity of the site’s data.