The CubeWP plugin contains a flaw that allows an attacker to inject SQL statements through unsanitized parameters. This allows unauthorized reading, modification, or deletion of data stored in the WordPress database. The weakness is identified as CWE‑89. Attackers can exploit this to compromise data confidentiality and integrity, but no further exploitation such as code execution is stated in the CVE data.

The CubeWP plugin developed by Imran Tauqeer is affected. Versions 1.1.30 and earlier are vulnerable. Any WordPress site that has these plugin versions installed is at risk.

The CVSS score of 8.5 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known exploitation yet. Based on the description, it is inferred that the attack vector is through publicly reachable web inputs that are incorporated into SQL statements without proper sanitization. Attackers would send crafted requests to the vulnerable code paths to manipulate database queries.