The vulnerability is an improper handling of user input in the WP Chill Download Monitor plugin that allows blind SQL injection. This flaw can enable an attacker to execute arbitrary SQL statements against the WordPress database, potentially exposing sensitive data or modifying the database contents. The weakness corresponds to CWE‑89.

The affected product is the WP Chill Download Monitor WordPress plugin. Versions from the earliest available through 5.1.8 are vulnerable. Users running any of these versions should be aware that the plugin is susceptible to injection attacks.

The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.6 indicates high severity. The attack vector is inferred to be a web request to the plugin’s input handling endpoint with specially crafted parameters; authentication requirements are unclear, but many similar vulnerabilities are exploitable without authentication. Due to the blind nature of the injection, an attacker would need to repeatedly probe the database to extract information, which may limit the speed of exploitation but still constitutes a serious threat if left unpatched.