This vulnerability is an SQL Injection flaw (CWE‑89) in the weDevs WP ERP plugin, allowing attackers to inject malicious SQL via unsanitized input. If exploited, an attacker could read, modify or delete data stored in the WordPress database, leading to confidentiality loss, data corruption or loss of availability of the site.

WordPress installations using the WP ERP plugin version 1.16.10 or any earlier release are affected. The issue applies to all plugin instances that may process user-supplied data without proper sanitization.

The CVSS score of 8.5 indicates high severity, while an EPSS score of less than 1% suggests the likelihood of active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by sending crafted input through the plugin’s exposed web forms or API endpoints, which then becomes part of an SQL statement. Successful exploitation would likely require access to a WordPress installation where the plugin is installed and possibly authenticated privileges depending on the plugin’s permission model.