ElementCamp, a WordPress plugin, contains a time‑based SQL injection flaw in the 'meta_query[compare]' parameter used by the 'tcg_select2_search_post' AJAX action. The attacker can supply arbitrary SQL operators, which bypasses the esc_sql() filter because the payload is not quoted. This allows an authenticated user to append additional SQL statements and extract sensitive data from the database.

All installations of ElementCamp up to and including version 2.3.6 are affected. The vulnerability can be exploited by any user with author‑level or higher access on a WordPress site where the plugin is active.

The base CVSS score of 6.5 indicates moderate severity. No EPSS score is available and there is no listing in the Known Exploited Vulnerabilities catalog. Because the flaw requires authenticated access, it is most likely to be used in targeted attacks against WordPress sites with the vulnerable plugin. The attack path is straightforward for users who already possess author‑level credentials.