The WPBot WordPress plugin before version 8.5.2 lacks input validation for administrator‑configured field identifiers that are incorporated into a SQL query. An administrator can inject malicious SQL through the qc_bot_str_fields setting, and the injection is executed when a site visitor triggers a search. This second‑order SQL injection allows the attacker to read, modify, or delete data in the site database, potentially compromising confidentiality, integrity, or availability of the site content.

Any WordPress installation that has the WPBot plugin installed with a version earlier than 8.5.2 and where the administrator has not upgraded the plugin. Only administrators of the site can inject the payload, but the execution occurs during a visitor‑initiated search, affecting all users.

The CVSS score of 3.8 indicates a low severity overall, and the EPSS score is low at < 1%. The vulnerability is not currently listed in CISA’s KEV catalog. The exploit requires both administrator privileges to inject the payload and a visitor action (search) to trigger the execution, which limits the attack window. However, once triggered, the injected SQL can compromise site data, and similar vulnerabilities in other plugins suggest a broader risk of exploitation if a site is not patched.