The vulnerability in the SEO Booster WordPress plugin is a time‑based SQL Injection that occurs through the 'orderby' request parameter. The unsanitized input is concatenated into an ORDER BY clause, enabling an attacker with administrator‑level credentials to append arbitrary SQL statements. This flaw can be leveraged to extract any data stored in the WordPress database, such as user accounts, passwords, or configuration settings, and is identified by CWE‑89.

WordPress sites running the SEO Booster plugin version 7.3.1 or earlier, provided by cleverplugins. The affected version range is all releases up to and including 7.3.1; any site utilizing this plugin without an upgrade to a newer version is potentially vulnerable.

The CVSS score of 4.9 indicates a moderate risk level, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Once achieved, an attacker can execute additional SQL queries and exfiltrate data.