The Attendance Manager plugin for WordPress contains an SQL Injection flaw in the 'attmgr_off' parameter. Because the value provided by users is not properly escaped and the surrounding SQL statement is not prepared, attackers can inject additional SQL statements. This allows the execution of unauthorised queries that can read sensitive database contents, potentially exposing user information and other confidential data.

All WordPress sites running the Attendance Manager plugin version 0.6.2 or older are affected. Attackers need only Subscriber‑level or higher privileges, which is common for normal site users.

The flaw has a CVSS score of 5.4, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑based request that an authenticated user can send to the plugin. Once the attacker injects the malicious payload, the database can be queried for information, leading to confidentiality compromise. Because no public exploit is documented, the risk is moderate to high depending on the attacker’s access level.