This vulnerability is a classic SQL injection flaw that affects the "Subscribing" feature of the Woffice theme for WordPress versions 5.4.35 and earlier. An attacker that can supply arbitrary input to the subscriber form can manipulate the underlying SQL query, enabling reading, modification, or deletion of any data stored in the WordPress database. The impact is a loss of confidentiality, integrity, and potentially availability of the site’s data.

Affected systems are all WordPress installations that deploy the Woffice theme at or below version 5.4.35. The vulnerability is present in every installation that allows unfiltered subscriber input to reach the database layer without proper validation or parameterization.

The CVSS score of 8.5 indicates high severity. The EPSS score is reported as < 1% and the vulnerability is not catalogued in CISA KEV list, so the public exploitation probability is very low, but the typical attack path would involve sending a crafted subscriber form submission via the web interface, which suggests a remote user can exploit it.