An attacker can inject malformed SQL into the QuantumCloud ChatBot WordPress plugin, causing the underlying database to execute unintended commands. The vulnerability derives from improper neutralization of special elements in SQL statements, enabling blind SQL injection (CWE‑89). This allows an unauthenticated attacker to read or modify database contents, potentially leading to data exfiltration or further exploitation if the database user holds elevated privileges.

Any WordPress site running the QuantumCloud ChatBot plugin with versions up to and including 7.7.9 is affected. This includes all installations from the earliest release through 7.7.9, as the vulnerability is present in every version within that range.

The CVSS score of 9.3 denotes a high severity, reflecting the potential for significant data loss or manipulation. The EPSS score is below 1%, indicating that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be via standard HTTP requests to the plugin’s functionality that accepts unsanitized input; no prior authentication is required, enabling public attackers to trigger the blind SQL injection.