This vulnerability is an SQL injection flaw in the Essekia Tablesome WordPress plugin that allows attackers to inject arbitrary SQL code into queries. The flaw stems from improper neutralization of special characters in user-supplied data, enabling a blind SQL injection attack. An attacker can exploit the vulnerability to read or modify sensitive data stored in the database, potentially compromising the confidentiality and integrity of the website’s contents.

WordPress sites installed with the Tablesome plugin version 1.2.3 or earlier are affected. All earlier plugin releases, from the initial release up to and including 1.2.3, are vulnerable. Site administrators should verify the plugin version regardless of the WordPress core version and consider the plugin a security risk until a fix is applied.

The vulnerability’s impact is remote SQL injection that can lead to data exfiltration or modification. It is unlikely to be actively exploited, as indicated by a very low EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. Because the flaw is present in code that handles user input without adequate validation, a malicious actor could attempt exploitation without requiring authentication, but the low probability suggests that this vulnerability is unlikely to be a target for widespread attacks.