The vulnerability originates from improper escaping of user-supplied input before it is incorporated into an SQL query. This flaw allows an attacker to inject arbitrary SQL commands, potentially reading, modifying, or deleting records in the WordPress database. The weakness is classified as CWE‑89 and represents a classic injection flaw that directly compromises data confidentiality and integrity.

WordPress sites that have the Lisfinity Core plugin (distributed by pebas) installed in any version up through 1.5.0 are vulnerable. The issue is independent of the underlying operating system or web server; it exists wherever the affected plugin code is present within the WordPress installation.

With a CVSS score of 9.3 the flaw is deemed critical. Although the EPSS score is below 1 %—suggesting a low probability of exploitation in the wild—the potential impact is high. Attackers can remotely exploit the flaw by sending crafted HTTP requests that trigger the injection point, enabling full read/write/delete access to the database. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants immediate attention.