The vulnerability is a SQL injection flaw that occurs when inputs from the Miraculous Core Plugin are passed directly into SQL commands without proper sanitization. Attackers can exploit this to perform blind SQL injection, which can read or modify sensitive data stored in the WordPress database. This weakness enables unauthorized data disclosure, data tampering, and potentially compromises the integrity and confidentiality of the site.

The affected product is the Miraculous Core Plugin produced by kamleshyadav. WordPress sites that include any version of the plugin earlier than 2.1.2 are vulnerable. No specific WordPress core version is mentioned, but any installation that has the plugin installed below the fixed release is at risk.

The CVSS score of 8.5 indicates a high severity level, and the EPSS score below 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which does not guarantee safety. An attacker can exploit it by sending specially crafted input through the plugin’s exposed parameters, explaining that the attack vector is most likely through available input fields that feed into database queries. If successfully used, the attacker could extract or alter database contents, resulting in data loss or site compromise.