The Rest Routes WordPress plugin up to version 5.5.5 contains a flaw where the table name supplied in the path of the public REST endpoint custom‑tables/tables/{table_name} is used directly in a SQL query without sanitization. Because no validation occurs, an unauthenticated attacker can inject arbitrary SQL code, allowing them to read or alter the database contents. This weakness aligns with CWE‑89, a vulnerability that can compromise data confidentiality, integrity, and availability.

All installations of the Rest Routes plugin for WordPress running version 5.5.5 or earlier are susceptible. The vendor does not specify a sub‑version, so any deployment that has not updated beyond 5.5.5 is considered vulnerable. The vulnerability resides in a public API endpoint, meaning that any site with the plugin enabled is at risk.

The EVIL vector is publicly reachable; the likely attack involves sending an unauthenticated HTTP request to the custom‑tables endpoint with a crafted table name to trigger SQL injection. Because authentication is not required, the risk is elevated and a successful exploit could lead to data exfiltration, modification, or deletion. The EPSS score is not available, and the flaw is not in the CISA KEV catalog, but the breadth of data in a typical WordPress database and the lack of any protection make the exploitability high.