The PublishPress Revisions plugin contains an SQL injection vulnerability caused by improper neutralization of special elements used in a SQL command. The flaw permits blind SQL injection, enabling an attacker to tamper with or retrieve data in the WordPress database. This could lead to unauthorized data disclosure, integrity compromise, or, depending on the database user, potential escalation of privileges.

All versions of PublishPress Revisions up to and including 3.7.23 are vulnerable. Users running any of these WordPress plugin versions are at risk if their sites are exposed to the web.

This vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web-based attack in which a malicious user posts crafted input through the plugin’s interface, triggering blind SQL injection. Given the high CVSS score, the risk is significant if exploitation occurs.