This vulnerability arises from improper neutralization of special elements in an SQL command, enabling blind SQL injection against the Arraytics Booktics WordPress plugin. An attacker can read, modify, or delete data stored in the WordPress database if they can send crafted requests to the plugin’s endpoints. The weakness is a classic input validation flaw identified as CWE‑89, and the potential impact is loss of data confidentiality and integrity across affected sites.

The flaw affects WordPress sites that have installed Booktics plugin version 1.0.22 or earlier. Anyone who relies on the plugin to manage book listings or user interactions is susceptible until the plugin is upgraded beyond version 1.0.22.

The CVSS score of 8.5 signals high severity, and while EPSS data is not available, the lack of a KEV listing does not decrease the risk of exploitation. The flaw is exploitable remotely via the plugin’s publicly accessible web interface, as the injection can be triggered through normal user inputs or API calls. In practice, a malicious actor could craft requests to the plugin, observe time‑based responses, and extract database contents or alter records.