This vulnerability is a SQL injection in the Image Uploader for Welcart plugin for WordPress that occurs when an attacker supplies crafted input through the 'post_title' parameter. The flaw stems from insufficient escaping and no prepared statement usage in earlier plugin versions. For an authenticated user with author-level permissions or higher, an attacker can inject arbitrary SQL code that is appended to existing queries, enabling extraction of sensitive data from the database, including potentially credentials or other confidential information. The weakness is classified as CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

The issue affects the Image Uploader for Welcart plugin developer fishpie, for all versions up to and including version 1.4.6. Any WordPress site using these plugin releases is vulnerable, regardless of WordPress core version. Sites with author or higher level roles are at risk. No specific WordPress core version constraints are listed.

The CVSS score of 6.5 indicates a medium severity, reflecting the need for authenticated access and the potential for data exposure. Because the EPSS score is not available, the public data do not indicate a current exploitation probability, but the absence of a KEV listing means there is no documented active exploitation. An attacker would need valid author or higher credentials to leverage the vulnerability and must craft the 'post_title' parameter to inject malicious SQL. The vulnerability could allow data extraction but does not directly lead to remote code execution.