A flaw in the UDesign Core WordPress plugin allows malicious input to be injected into SQL statements. Attackers could manipulate database queries to retrieve, modify, or delete data, leading to data loss or compromise of sensitive information. The weakness corresponds to CWE‑89, which describes how improper input handling leads to SQL injection vulnerabilities.

The vulnerability affects the AndonDesign UDesign Core plugin versions up to and including 4.15.0, which is deployed in many WordPress sites. Any site using one of these versions is susceptible.

The CVSS score of 8.5 signals moderate to high severity. The EPSS score is < 1%, indicating a very low probability of exploitation but not zero. The absence of a KEV listing does not reduce the risk if attackers can exploit the flaw in the wild. Exploitation can be achieved remotely by crafting input in subscriber fields, so any external interface that accepts such data could be used as an attack vector.