The Quentn WP plugin is vulnerable to SQL injection through the unescaped 'qntn_wp_access' cookie, allowing unauthenticated attackers to append malicious SQL to existing queries and retrieve sensitive database information such as user credentials and site content.

WordPress sites with Quentn WP plugin version 1.2.12 or earlier are affected, as the flaw exists in all releases up to and including that version.

The CVSS score of 7.5 indicates high severity, and the vulnerability can be exploited without authentication, making any vulnerable system with a functioning database a target. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation at present. The attack vector is inferred to be HTTP based, via cookie manipulation, which is the most direct way to supply the malicious input.