The Term Pages WordPress plugin before version 2.0.0 fails to sanitize and escape a user-supplied parameter before including it in an SQL query. This flaw permits attackers who need not have any credentials on the site to inject arbitrary SQL code. If successfully exploited, the attacker could read sensitive data, modify database contents, or potentially gain further system compromise through privileged database actions, leading to a full breach of confidentiality, integrity, and availability for the affected WordPress site.

The vulnerability affects all installations of the Term Pages plugin with a version lower than 2.0.0. No specific WordPress core versions are imposed, and any site hosting the affected plugin is at risk.

While no EPSS score is publicly provided, the absence of authentication requirements and the use of a common web endpoint make exploitation highly probable in practice. The vulnerability is not reported in the CISA KEV catalog. Attackers would need to craft a malicious request to the plugin’s lookup routine, as the plugin exposes an unauthenticated interface that directly incorporates user input into SQL statements. Once injected, arbitrary SQL commands can be executed with the privileges of the database user that the WordPress application uses.