An improper neutralization of special elements in SQL commands has been identified in VeronaLabs WP SMS plugin up through version 6.9.12. The flaw allows an attacker to inject arbitrary SQL statements into the database. If exploited, the attacker could read, modify, or delete site data, including user credentials and messages, potentially compromising the integrity and confidentiality of the WordPress site. This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

WordPress sites that have the WP SMS plugin installed and running a version no higher than 6.9.12 are vulnerable. The plugin is developed by VeronaLabs and is commonly used to send SMS notifications from WordPress sites.

The vulnerability carries a CVSS score of 7.6, indicating high severity. The EPSS score of less than 1% suggests a low current probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, via the plugin’s web interfaces, and the attacker would need to construct a malicious input that the plugin passes directly to the database. No authentication requirement is explicitly stated, but the plugin’s typical use within site administration makes it plausible that an authenticated site administrator could execute the attack more easily.