The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, classified as CWE-89. This flaw allows a blind SQL Injection that can be exploited to read, modify, or delete data stored in the database. The lack of proper input sanitization means that an attacker can construct malicious queries to extract sensitive information or manipulate content within the WordPress database, potentially compromising confidentiality and data integrity.

The affected product is the WordPress Collapsing Archives plugin (robfelty:Collapsing Archives). All versions from the initial release through version 3.0.7 are vulnerable. No specific sub‑versions are excluded in the vendor's advisory.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Although the description does not explicitly state the attack vector, the plugin is publicly accessible through a WordPress site, so the likely attack vector is remote unauthenticated exploitation via crafted requests to the plugin’s endpoints. Once exploited, an attacker can perform blind queries to glean or alter database contents.