CMS Commander plugin for WordPress can execute SQL injection via the or_blogname, or_blogdescription, and or_admin_email parameters because they are not properly escaped and the queries lack prepared statements. This flaw allows an attacker who has an API key and is authenticated to the plugin to add arbitrary SQL fragments to existing queries and retrieve sensitive information from the database. The vulnerability enables direct data exfiltration, which may lead to further compromise of the site by exposing credentials, confidential content, or other valuable data.

The flaw is present in all versions of the CMS Commander plugin up to and including release 2.288. The plugin is distributed by thoefter as CMS Commander – Manage Multiple Sites for WordPress. Any WordPress site that has this plugin installed and is running a version 2.288 or older is vulnerable. The risk applies only when the attacker can obtain or abuse a valid CMS Commander API key, which grants authenticated access to the plugin's restore workflow.

The CVSS base score for the issue is 8.8, indicating high severity. The exploit probability score is not publicly available, but the vulnerability requires authenticated access rather than unauthenticated remote code execution. As the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, no evidence of active exploitation in the wild is reported yet. Nevertheless, the attack path is relatively straightforward for an insider or compromised API key holder and can result in immediate disclosure of database contents.