A SQL injection flaw exists in the Subscriber handling of the Do Lasso plugin for WordPress versions 358 and below. The vulnerability allows an attacker to inject arbitrary SQL statements through unsanitized subscriber input, potentially enabling the attacker to read sensitive data, modify database records, or execute destructive queries against the WordPress database. The weakness is classified as CWE‑89.

Lasso Analytics, Inc. product Do Lasso plugin version 358 or earlier. WordPress sites running these affected plugin versions are at risk; newer releases do not contain the issue.

The CVSS score of 8.5 indicates a high severity. EPSS data is not available, but the lack of a KEV listing suggests there is no current evidence of widespread exploitation. Based on the plugin’s interaction model, the attack vector is likely remote via crafted HTTP requests targeting the subscriber submission endpoint. An attacker would need to supply malicious input that bypasses current input validation, after which the plugin executes the payload against the database.