WordPress Qode Tours plugin versions 3.1.3.2 and earlier are susceptible to a subscriber-related SQL injection flaw (CWE‑89). The vulnerability allows an attacker to inject malicious SQL code through input fields associated with subscriber operations, potentially granting unauthorized read or write access to the database, including sensitive user credentials and configuration data. This can lead to data compromise, defacement, or further exploitation within the host environment.

Vendors affected are QODE with the Qode Tours plugin up to and including version 3.1.3.2. Any WordPress installation using these plugin versions without upgrading to a newer release is vulnerable.

The CVSS score of 8.5 classifies this flaw as high severity. With no EPSS score provided, the current exploitation probability is unknown, but the flaw is not listed in CISA KEV, indicating no confirmed active exploitation at this time. The likely attack vector is remote via the plugin’s web interface, where an attacker could supply malicious input in subscriber-related fields to execute arbitrary SQL queries.