The vulnerability is a classic SQL Injection in the Plugin Organizer plugin for WordPress, triggered by the ‘PO_plugin_path’ AJAX parameter. Because the value is not properly escaped before being inserted into a SQL query, attackers can inject additional SQL statements. The flaw is aggravated by the absence of nonce verification and capability checks in the AJAX handler, which means that any authenticated user with subscriber level or higher permissions can exploit it. Consequently, an attacker can read, modify, or delete database information, compromising the confidentiality and integrity of all WordPress data stored in the database.

WordPress sites running the Plugin Organizer plugin by foomagoo, versions up to and including 10.2.4, are affected. Any installation of these versions that has enabled the plugin’s AJAX functionality and has users with subscriber or higher access levels is vulnerable.

The CVSS score of 6.5 classifies the vulnerability as a moderate severity. The EPSS score of less than 1 percent indicates a low likelihood of active exploitation under current data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated subscriber or higher account, and the attacker must be able to access the Plugin Organizer’s AJAX endpoint. Because the flaw relies on inserting arbitrary SQL, it can lead directly to data exfiltration or manipulation if the attacker has any database privileges beyond the targeted queries. While the attack vector is limited to authenticated users, the impact on the affected site’s data integrity and privacy is significant.