NooTheme Organici Library version 2.1.2 includes an unsanitized database query that permits blind SQL injection, a flaw recognized as CWE-89. An attacker who can send crafted requests to the plugin may read or modify database contents, leading to confidentiality and integrity violations and possible data exfiltration.

The vulnerability affects the NooTheme Organici Library plugin for WordPress, specifically all releases through 2.1.2. Users running this or earlier versions are potentially exposed.

The CVSS score of 8.5 signals a high severity vulnerability. Although the EPSS score is below 1%—suggesting a low likelihood of widespread exploitation—the impact is significant if an exploit is discovered. Because the plugin is web‑accessible, the likely attack vector is remote, though it may require administrative or privileged access depending on the deployed configuration. The vulnerability is not currently listed in the CISA KEV catalog.