This vulnerability results from improper neutralization of special characters in SQL commands within the eMagicOne Store Manager plugin, enabling blind SQL injection. A remote actor can craft payloads that cause the database to execute arbitrary queries, allowing read or manipulation of data stored by the plugin. The potential impact includes extraction of confidential information and alteration of stored records.

All releases of eMagicOne Store Manager up to and including version 1.3.2 are affected. Any WordPress site that has any of these plugin versions installed is susceptible to the flaw.

The CVSS score of 9.3 classifies the issue as critical. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely submit crafted input to the plugin’s endpoints, and because the injection is blind, impact is inferred through response timing or side‑channel behavior. The high severity and lack of mitigation pose a significant risk.