The Pre* Party Resource Hints WordPress plugin contains a SQL injection flaw in the hint_ids parameter of the pprh_update_hints AJAX action. User input is not properly escaped and the SQL query is constructed without adequate preparation, allowing an attacker with Subscriber or higher privileges to append arbitrary SQL statements. This can lead to extraction of sensitive information such as user data, posts, and other database contents, constituting an information disclosure vulnerability (CWE‑89).

Any WordPress site that has installed samperrow's Pre* Party Resource Hints plugin in a version up to and including 1.8.20 is vulnerable. The vulnerability is exploitable by any authenticated user with the Subscriber role or higher; therefore sites with such users or with unrestricted subscriber access may be affected.

The CVSS score of 6.5 places the flaw in the moderate range, and the lack of an EPSS score or KEV listing suggests that large‑scale exploitation is not yet widespread. The exploit requires authenticated access, so disabling or restricting subscriber privileges, or temporarily deactivating the plugin, can mitigate the risk until a patch is applied. If exploited, an attacker could gain read or potentially write access to the entire WordPress database, compromising the site’s confidentiality and integrity.