The WP ERP Pro plugin for WordPress suffers from a classic SQL injection flaw through the 'search_key' parameter. Inadequate escaping and the absence of prepared statements allow an attacker to inject arbitrary SQL code, enabling extraction of confidential database contents. This vulnerability can expose personal user data or other sensitive information stored within the WordPress database, impacting the confidentiality of the site.

All installations of the weDevs WP ERP Pro plugin up to and including version 1.5.1 are affected. The flaw is present in every released version prior to 1.5.1, regardless of the WordPress site version or hosting environment. Users running WP ERP Pro 1.5.1 or earlier should verify the plugin version and consider upgrading immediately.

The CVSS score of 7.5 marks this issue as High severity. Exploitation requires no authentication and can be carried out by sending a crafted request to the plugin’s search functionality; however, EPSS data is unavailable, making it unclear how frequently attackers are leveraging this flaw. The vulnerability is not listed in the CISA KEV catalog, but the potential for data exfiltration remains significant given the nature of the SQL injection vector.