The vulnerability is a classic SQL injection flaw (CWE-89) discovered in the OttoKit “suretriggers” feature of the Brainstorm Force WordPress plugin. It occurs because the plugin fails to properly sanitize special characters that are incorporated into an SQL query. An attacker can craft a request that injects arbitrary SQL code, leading to a blind SQL injection scenario. Successful exploitation allows the attacker to read, alter, or delete data stored in the WordPress database, thereby compromising the confidentiality, integrity, and availability of site content and user information.

All WordPress sites that have installed the OttoKit plugin version 1.1.20 or earlier are affected. The issue applies to all releases from the initial release (n/a) through 1.1.20 regardless of site configuration or user role.

The CVSS base score of 7.6 indicates a high severity. The EPSS score is below 1%, suggesting a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the plugin’s trigger endpoint over HTTP, inferred from the plugin’s normal operation. If an attacker can reach this endpoint, they may send crafted payloads that trigger blind SQL injection, potentially enabling data exfiltration or site compromise. The combination of high severity and low exploitability still warrants immediate attention to prevent possible future exploitation.