Improper neutralization of special elements in SQL commands within the RealMag777 WOLF bulk‑editor plugin results in blind SQL injection. An attacker who can reach the plugin’s interface can inject crafted SQL statements that are executed against the underlying database. This can expose sensitive data, modify records or compromise the entire application, representing a significant confidentiality, integrity and availability risk.

The vulnerability affects the RealMag777 WOLF plugin for WordPress in all versions up to and including 1.0.8.7. No specific sub‑versions are excluded; the issue is present from the earliest available release through 1.0.8.7.

The CVSS v3 base score of 7.6 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via the plugin’s bulk‑editor endpoint, and requires the attacker to be able to send HTTP requests that include the injection payload.