The vulnerability is a time‑based SQL injection that allows an unauthenticated attacker to inject and execute arbitrary SQL statements through the 'link_url' parameter of the Link Library WordPress plugin. Because the parameter is not properly escaped and the query is not prepared, an attacker can append SQL commands to a request and retrieve sensitive database information. This flaw exposes the confidentiality of the database content and may be a stepping stone to further exploitation.

WordPress sites running the Link Library plugin from jackdewey, versions 7.9.2 and earlier, are affected. Any installation that has not yet upgraded beyond 7.9.2 is at risk.

The CVSS score of 7.5 indicates high severity, and the lack of an EPSS score means we cannot quantify current exploitation probability, but the flaw is already listed on multiple advisory sites, indicating that exploitation is realistic. The vulnerability is exploitable by unauthenticated users via normal HTTP requests, using a time‑based injection technique that relies on delays to confirm injection success. Even though the plugin is not in the KEV catalog, the high severity and unauthenticated nature make timely mitigation essential.