The vulnerability is an unauthenticated SQL Injection flaw present in all SpeakOut! Email Petitions plugin releases up to and including version 4.6.5. The flaw allows an attacker to inject arbitrary SQL statements through the plugin’s input handling, which can be used to read, modify, or delete data stored in the WordPress database. The high CVSS score of 9.3 reflects the significant impact on confidentiality and integrity of a site that relies on this for broader compromise if the underlying database can be coerced into executing additional malicious commands.

This issue affects sites running the WordPress SpeakOut! Email Petitions plugin version 4.6.5 or earlier. The plugin is distributed by SpeakOut! and is available to any WordPress installation that includes it.

With an EPSS score of less than 1%, the likelihood of exploitation is currently very low, but the vulnerability is still considered critical by CVSS criteria. The flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack vector is inferred to be through unauthenticated HTTP requests to the plugin’s exposed endpoints, allowing any visitor to supply crafted input that bypasses normal sanitization checks.