Improper neutralization of special elements in an SQL command allows the Profile Builder Pro plugin to be exploited via blind SQL injection. An attacker can manipulate input parameters to retrieve, modify, or delete data stored in the database, potentially exposing sensitive user information or enabling further compromise.

All WordPress installations that use Cozmoslabs Profile Builder Pro version 3.13.9 or any earlier release are affected. The vulnerability applies to every instance of the plugin deployed before the 3.14.0 release.

The CVSS score of 9.3 marks this flaw as critical, and while the EPSS score indicates a low probability of exploitation currently (<1%), the potential impact remains high. The exploit is performed through web interfaces provided by the plugin, likely requiring access to plugin forms or endpoints. Once an injection is successful, the attacker can extract or alter data, and, depending on database privileges, may achieve further lateral movement. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been reported yet.