Technical impact
The Database Collation Fix plugin is vulnerable to time‑based SQL injection through the 'force-collation-algorithm' parameter. Insufficient escaping allows an unauthenticated attacker to inject arbitrary SQL, which can be used to read or extract sensitive content from the database. The flaw enables an attacker to append additional SQL statements to existing queries, potentially retrieving confidential information such as user credentials or site data. This weakness is a classic example of CWE‑89 (SQL Injection).
Affected Systems
Any WordPress installation that has the Database Collation Fix plugin installed in version 1.2.10 or earlier is affected. The vulnerability is active for sites that have the plugin activated and that have a 'trigger.txt' file present in the plugin's directory (/wp‑content/plugins/database‑collation‑fix/). Similar configurations may arise in environments utilizing DesktopServer integration events such as site creation, copy, import, move, export, or deploy, which commonly create this file.
Risk and Exploitability
Because the flaw can be triggered without authentication, the opportunity for exploitation is higher than for privileged‑only bugs. The CVSS score of 5.3 indicates a moderate impact. However, the EPSS score of less than 1% and absence from the CISA KEV catalog suggest that, as of now, exploitation is unlikely to be widespread. Inferred, the attack vector is through normal web traffic to the WordPress site, with the attacker supplying the vulnerable parameter in a request. The 'trigger.txt' requirement conditions the vulnerability to environments that create this file; thus, only sites that have experienced a DesktopServer integration event are fully vulnerable.
