An input field in the WordPress User Feedback plugin is not properly sanitized, allowing an attacker to perform a blind SQL injection. This flaw can let malicious users read data from the database, potentially exposing user information, site content, and other confidential data. The underlying weakness is a classic SQL injection error involving unsanitized user input.

The vulnerability affects the WordPress plug‑in User Feedback, developed by Syed Balkhi. All releases up to and including version 1.10.1 are impacted; later versions are not known to be affected. Site administrators should verify that the installed plug‑in is a version newer than 1.10.1 to avoid exploitation.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1 % suggests a low current exploitation likelihood. The plug‑in is not listed in the KEV catalogue, indicating no widespread active attacks are documented. An attacker is likely to target the public feedback form of the plug‑in, send specially crafted requests, and use timing or error responses to perform blind extraction of database contents. The attack would compromise confidentiality of the site’s data.