The User Login History plugin for WordPress contains a SQL Injection vulnerability in the 'blog_id' parameter. The insufficient escaping allows an authenticated attacker with Administrator-level or higher privileges to inject arbitrary SQL statements and exfiltrate sensitive data from the database. This flaw can compromise confidentiality of database contents but does not provide arbitrary code execution.

WordPress multisite installations running the User Login History plugin up to and including version 2.1.7 are affected. The flaw is specific to the multisite context and requires that the attacker possess administrator or higher credentials on the site network.

The CVSS score of 4.9 indicates a moderate severity flaw, and the EPSS score is not available, suggesting low to moderate likelihood of widespread exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated administrator in a multisite deployment; the attacker would need to construct a malicious 'blog_id' query parameter to intercept or dump database data. Consequently, the risk is moderate for sites that have the vulnerable plugin activated on a multisite network and rely on administrators for routine operations.