The WP Sessions Time Monitoring Full Automatic plugin lists a vulnerability that allows an attacker to inject SQL code into the database. A successful injection could enable the attacker to read, modify, or delete data from the WordPress database, potentially compromising the integrity, confidentiality, and availability of the entire site. The weakness is a classic example of CWE‑89, where user-supplied input is concatenated into SQL statements without proper sanitization.

WordPress sites running the WP Sessions Time Monitoring Full Automatic plugin from activity‑log.com with a version of 1.1.4 or earlier are affected.

The CVSS score of 8.5 designates this flaw as high severity, while an EPSS score of less than 1% indicates a very low known exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is web‑based; an attacker must be able to submit specially crafted input to the plugin’s subscriber handling logic, which could be available to authenticated users or even unauthenticated users depending on site configuration. No additional infrastructure or privileged access is required beyond reaching the vulnerable input endpoint.