The OttoKit All‑In‑One Automation Platform WordPress plugin fails to sanitize user input before incorporating it into a SQL statement. This flaw permits unauthenticated attackers to inject arbitrary SQL code. The impact is the potential compromise of confidential data, unauthorized data manipulation, and possible escalation to further system compromise.

All installations of the OttoKit All‑In‑One Automation Platform WordPress plugin with a version earlier than 1.1.23 are affected. The vulnerability applies to the plugin’s components that handle user‑supplied data via their web interface.

The vulnerability is exploitable without authentication through any publicly reachable endpoint of the plugin. No EPSS score is available and the issue is not listed in the CISA KEV catalog, indicating a lower profile but still actionable risk. The lack of a public exploit does not negate the severity; attackers can craft payloads to read or manipulate database contents. The CVSS score is unspecified, but the nature of the flaw and lack of mitigations suggest a high severity. The attack vector is likely through web requests to the plugin’s exposed endpoints, and success requires only the ability to send arbitrary input to those endpoints.