The vulnerability is an improper neutralization of special elements in SQL commands, which permits blind SQL injection. An attacker can send crafted requests that result in the plugin executing unintended database queries. This could allow the attacker to read, modify, or delete site data, compromising confidentiality, integrity, and potentially availability of the application. The weakness matches CWE‑89.

The flaw affects the Broken Link Checker plugin for WordPress, distributed by WPMU DEV under the Your All‑in‑One WordPress Platform brand. Versions from the earliest release through 2.4.7 are vulnerable.

The CVSS base score of 7.6 indicates high severity, while the EPSS score of less than 1 % suggests the exploit is not yet widely used. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through HTTP requests to the plugin’s endpoints, meaning an unauthenticated remote attacker could trigger the injection if the site is publicly accessible. Given the sensitivity of database operations, the risk to systems is significant if the plugin remains active.