This vulnerability arises from improper neutralization of special elements in an SQL command within the Fox LMS WordPress plugin, a weakness classified as CWE-89. The flaw allows blind SQL injection, enabling an attacker to read, modify, or delete data in the database without authentication. The impact includes exposure of sensitive learner information, loss of data integrity, and downstream compromise of the WordPress site.

All installations of the Ays Pro Fox LMS (fox-lms) WordPress plugin up to and including version 1.0.6.3 are affected. No later versions are listed as vulnerable. Administrators should verify the plugin version in use.

The CVSS score of 8.5 marks this as a high severity issue, while the EPSS score indicates a low exploitation likelihood at less than 1%. It is not part of the CISA KEV catalog. Exploitation would likely occur through unauthenticated HTTP requests to plugin endpoints that accept user input, requiring an attacker to orchestrate blind queries and interpret timing or error responses to extract data.