An attacker can exploit the UpsellWP plugin version 2.2.4 or earlier by injecting malicious SQL statements into specially crafted input fields. This entry describes an improper neutralization of special elements in SQL queries, leading to blind SQL injection. The vulnerability is based on CWE‑89. Successful exploitation could allow the attacker to read, modify or delete data from the WordPress database, potentially compromising site content and user data. The impact covers confidentiality and integrity of database information, with a potential to affect the entire website if network access is limited only to the hosting environment.

The plugin UpsellWP (checkout‑upsell-and-order‑bumps) by flycart is affected from the earliest available version through 2.2.4. WordPress installations running the plugin at any of those versions are vulnerable.

The vulnerability carries a CVSS v3.1 score of 8.5, indicating high severity. The EPSS score is below 1%, suggesting a low probability of observation in the past year, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote through web input, but a specific path or preparatory conditions are not stated in the source data. As best practice, all clients should assume that the flaw could be exploited without authentication or with restricted privileges depending on the targeted database user.