The Persistent Login plugin for WordPress contains a generic SQL Injection flaw in the handling of the 'wppl_device_id' cookie. Because the plugin fails to escape the cookie value and does not properly prepare the existing SQL statement, an attacker who is already logged in with subscriber level or higher can inject malicious SQL commands. This flaw is tied to a CWE‑89 vulnerability and can be used to retrieve sensitive data from the database once exploited.

The vulnerability exists in all releases of the Persistent Login plugin up to and including version 3.1.0. The affected vendor is lukeseager, and the product is the Persistent Login WordPress plugin. Users running 3.1.0 or older, especially with the Login History feature enabled, are at risk.

The CVSS score of 6.5 indicates a moderate severity. The EPSS value is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated as a subscriber or higher and that the Login History feature be active. The likely attack vector is through manipulation of the cookie sent from a client that has already logged in. Because the exploit is limited to authenticated users with specific privileges, the attack surface is narrower, but the ability to extract sensitive data makes it a non‑trivial risk for affected sites.