The SQL Chart Builder WordPress plugin contains a flaw that permits attackers to inject arbitrary SQL statements through its dynamic filter feature. User input is concatenated into database queries without proper escaping, creating a classic case of SQL injection, a CWE‑89 weakness that can enable unauthorized retrieval, modification, or deletion of database contents. The impact is that confidential data stored by the site may be compromised, and database integrity may be undermined.

All WordPress sites that have installed the Guaven SQL Chart Builder plugin at a version earlier than 2.3.8 are affected. Versions 2.3.8 and higher, or installations that do not use the plugin, are not vulnerable.

The CVSS v3 score is 6.5, indicating medium severity, while the EPSS score is reported as less than 1 %, implying a low current likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker can exploit the flaw by sending unauthenticated HTTP requests to the plugin’s dynamic filter endpoint, which is publicly reachable. No further exploitation prerequisites are detailed in the CVE data.