Roundcube Webmail's virtuser_query plugin has a flaw that bypasses backslash escaping in preg_replace, allowing the execution of arbitrary SQL statements without authentication. The vulnerability stems from inadequate sanitization of user input before it is incorporated into database queries, which can enable an attacker to query, modify, or delete data stored in the mail server's database.

This issue affects installations of Roundcube Webmail version 1.6.x before 1.6.16 and version 1.7.x before 1.7.1 when the virtuser_query plugin is enabled. The vulnerability is tied to the plugin code referenced in the provided commits and release notes.

The CVSS score of 8.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. An attacker can trigger the flaw by sending crafted requests to the webmail interface that target the virtuser_query plugin, gaining the ability to inject and execute SQL commands without needing authentication.