The AI Copilot – Content Generator plugin for WordPress contains a SQL Injection flaw that is triggered by the 'order[0][dir]' parameter in its AJAX handler. Because the parameter is embedded directly in a constructed query without escaping or parameterization, malicious SQL can be appended and executed. An attacker who is authenticated at the subscriber level or higher and can embed the [waic_form] or [aiwu-form] shortcodes is able to build the required nonce and target the vulnerable endpoint, thereby reading or manipulating sensitive information stored in the database.

All versions of the Wupsales AI Copilot – Content Generator plugin up to and including 1.5.4 are affected. The vulnerability is present in the core class responsible for handling table sorting, which uses the unvalidated 'order[0][dir]' value.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is not common. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through an authenticated user’s ability to embed shortcodes and construct a request to the AJAX endpoint; the absence of a capability check beyond nonce verification makes it possible for any contributor or higher to exploit it. Given that the flaw requires legitimate credentials rather than a publicly accessible entry point, the risk to non‑authenticated users is limited, but a compromised or malicious contributor can extract confidential data, presenting a moderate confidentiality risk.