The vulnerability arises from improper sanitization of user supplied input that is incorporated into SQL queries, allowing a blind SQL injection attack. An attacker can craft input that leaks database contents or modifies database state without direct feedback, leading to unauthorized data access or persistence of malicious data. This is a classic SQL Injection weakness which is mapped to CWE‑89 and can undermine the confidentiality and integrity of the application’s data.

King‑Theme Lumise Product Designer for WordPress is affected for all versions prior to 2.0.9. Administrators running any of these older plugin releases are at risk if the plugin’s administrative interface is exposed to potential attackers.

The high CVSS score of 9.3 reflects the severe impact of this flaw, while a very low EPSS score of less than 1 percent suggests limited current exploitation activity. The vulnerability is not present in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is likely remote, executed through crafted HTTP requests to the plugin’s input handling endpoints. Successful exploitation requires the ability to send crafted data to the plugin; no additional authentication or local privileges are indicated in the description. Given the severity, this flaw represents a high risk to any system that uses the vulnerable plugin version.