A flaw in the WordPress WZone plugin permits attackers to inject arbitrary SQL commands by bypassing the neutralization of special elements used in SQL queries. This results in blind SQL injection, allowing the attacker to read, modify, or delete sensitive database records, thereby compromising user data and site integrity. The issue is a classic instance of CWE-89.

The vulnerability targets the AA‑Team WZone plugin for WordPress, affecting every installation from the earliest version up to and including 14.0.31. Any WordPress site that has this plugin installed and is using a vulnerable version is susceptible; no other product or platform specifics are mentioned.

The vulnerability carries a CVSS score of 8.5, classifying it as high severity. An EPSS score of less than 1% indicates a low likelihood of current exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog, meaning no confirmed public exploits are known. The likely attack vector is any input that the plugin incorporates into SQL statements without proper sanitization; specific entry points are not detailed, so the inference is based on the nature of the flaw.