This vulnerability is a blind SQL Injection in the WP EasyCart plugin due to improper neutralization of special elements in an SQL command. Attackers can insert crafted input that is executed by the database without error feedback, allowing them to read, modify, or delete data in the WordPress database, potentially leading to site compromise or data exfiltration.

The vulnerability affects the levelfourdevelopment WP EasyCart plugin on WordPress sites. All releases from n/a through version 5.8.13 are impacted, so any installation using WP EasyCart 5.8.13 or earlier is at risk.

The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% suggests the probability of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via web requests to the plugin’s input fields, where attackers can supply malicious payloads that are executed by the database in a blind manner. Successful exploitation would enable data access or modification.