The vulnerability is a classic SQL Injection flaw (CWE‑89) that allows an attacker to inject malicious SQL code into queries executed by the Gopiplus Post title marquee scroll plugin. Due to improper neutralization of special elements within SQL commands, a malicious user can perform blind extraction of data from the database. The flaw exposes the database to unauthorized data exfiltration, potentially compromising confidential information held by the WordPress site.

All installations of the Gopiplus Post title marquee scroll WordPress plugin from the earliest releases up to and including version 9.9 are affected. Sites using these versions are at risk until the plugin is upgraded beyond version 9.9.

The CVSS score of 7.6 indicates a high severity level. The EPSS score is not available, but the lack of a KEV listing suggests no widespread known exploitation to date. The likely attack vector is via web input fields that the plugin processes; an attacker would need to supply crafted input to trigger the injection, which can then be used for blind data extraction. Given the high CVSS, the exploitability is considered significant, especially for publicly accessible sites that do not employ additional input validation layers.