The WordPress plugin contains an unauthenticated SQL injection flaw because the 'consent' parameter is not properly escaped or prepared. An attacker can supply malicious input to append or alter SQL statements, allowing extraction of sensitive database information such as user credentials and site content. This weakness is categorized under CWE-89.

Any WordPress installation running the WeePie Cookie Allow plugin version 3.4.11 or earlier is affected. The plugin is distributed through the CodeCanyon marketplace and is listed by the vendor as WeePie Cookie Allow.

The likely attack vector is a simple HTTP request where an unauthenticated user supplies the malicious 'consent' value. The CVSS score of 7.5 indicates moderate to high severity. EPSS is currently not available, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw permits data exposure without authentication, administrators should consider it a significant risk to confidentiality.