The Apocalypse Meow plugin for WordPress is vulnerable to SQL injection because a logical operator used in the type validation check is incorrect. The flawed ‘&&’ causes the in_array() validation to never run for non‑empty values, and a preceding call to stripslashes_deep() removes protective slashes. This allows an authenticated user who has Administrator-level access or higher to inject additional SQL statements into existing queries, potentially extracting sensitive data from the database.

The vulnerability affects the Apocalypse Meow WordPress plugin distributed by blobfolio. All versions up to and including 22.1.0 are impacted; later releases are not known to contain this flaw.

The CVSS score is 4.9, indicating moderate severity, and the EPSS score is less than 1%, implying a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated administrator account, so the attack surface is limited to sites where such credentials exist. Despite the low probability of remote exploitation, the potential impact on data confidentiality within a compromised site warrants attention.