The vulnerability is an unvalidated type of blind SQL injection in the TableOn – WordPress Posts Table Filterable plugin. The flaw occurs when the public AJAX endpoint processes the filter_data[comment_count] value without proper sanitization or preparation, allowing attackers to inject additional SQL fragments. Because the injection is blind, the attacker can discover sensitive database details such as database name, user credentials, or other site content, resulting in unauthorized data exposure. This flaw is categorized under CWE‑89, representing SQL injection weaknesses.

This issue affects installations of the TableOn – WordPress Posts Table Filterable plugin for WordPress versions up to and including 1.0.5.1. The vendor, realmag777, enumerated this as a WordPress plugin. No specific WordPress core or additional vendor is affected beyond the plugin itself.

With a CVSS score of 7.5, the severity falls into the high‑risk range, indicating that the vulnerability could have serious consequences for confidentiality and integrity. No EPSS value is available, so the likely exploitation probability is unknown; however, the attack can be performed unauthenticated via a public AJAX action, meaning that any internet‑reachable site running the vulnerable plugin could be targeted. The vulnerability is not listed in the CISA KEV catalog, but its high score and unauthenticated nature suggest that threat actors may already be probing affected sites.