The AI Chatbot & Workflow Automation by AIWU plugin contains an unauthenticated SQL Injection flaw in the getListForTbl() function caused by insufficient escaping and lack of query preparation. This weakness, classified as CWE-89, allows an attacker to inject and execute arbitrary SQL against the WordPress database, potentially exposing sensitive information such as user credentials, site content, or configuration data. The effect is a loss of confidentiality through data theft, with no documented path to arbitrary code execution or system compromise.

WordPress sites running the AI Chatbot & Workflow Automation by AIWU plugin version 1.4.17 or earlier are affected. The vendor identified is wupsales. Only the specific plugin product and its version range are listed; other WordPress components are not impacted.

The vulnerability carries a CVSS score of 7.5, placing it in the high severity range. EPSS information is not available, so the likelihood of exploitation cannot be quantitatively assessed. The issue is not listed in the CISA KEV catalog. Based on the description, the attack is likely performed by sending crafted HTTP requests to plugin endpoints that invoke getListForTbl(), and because the vulnerability is unauthenticated, any visitor to the site can exploit it. A partial mitigation was added in version 1.4.11 by introducing a nonce check that is only available to administrators.