The vulnerability exists in WP Bulk Delete versions up to 1.4.2 and stems from improper escaping of the delete_user_roles parameter. Because no prepared statement or sanitization is performed, an attacker who can authenticate as an administrator can inject additional SQL statements into the existing query and retrieve sensitive database information. This flaw is a classic injection bug and is classified as CWE-89.

The affected product is the WordPress plugin WP Bulk Delete by xylus, versions up to and including 1.4.2. All instances of the plugin running these or earlier versions are vulnerable. WordPress sites that have installed WP Bulk Delete in any such version must address the flaw.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at the current time, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an attacker who already has administrator-level access to a WordPress site; from that position the attacker can inject arbitrary SQL commands to extract sensitive data from the database.