An attacker can exploit a blind SQL injection flaw in the Nelio Content WordPress plugin (versions 4.2.0 and earlier) by submitting crafted input that bypasses sanitization. Based on the description, it is inferred that the flaw permits unauthorized reading or alteration of data stored in the WordPress database, potentially leading to confidentiality and integrity violations.

WordPress sites running the Nelio Content plugin from Nelio Software, any versions up through 4.2.0. The vulnerability is specific to the plugin’s database handling routines.

The flaw receives a CVSS score of 8.5, indicating high severity, but its EPSS score is less than 1%, suggesting a low probability that it will be actively exploited. The vulnerability is not listed in the CISA KEV catalog, so no evidence of known active exploitation exists. Based on the description, it is inferred that attackers would need web access to the plugin’s input channels; the injection is blind, requiring only the presence or absence of query results to infer data.