Technical impact
The vulnerability is an unsanitized SQL injection flaw that occurs in the subscriber component of the WordPress Attendance Manager plugin. Attackers can inject arbitrary SQL through unvalidated subscription data, allowing them to read sensitive database records or modify existing entries. This can compromise confidentiality, integrity, and availability of the site’s data.
Affected Systems
WordPress users running the Attendance Manager plugin version 0.6.2 or earlier, distributed by tnomi, are impacted. Any installation that has not upgraded to at least 0.6.3 remains vulnerable.
Risk and Exploitability
The CVSS score of 7.6 indicates high severity, but the EPSS of less than 1% suggests that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. Attackers would most likely target the plugin via a crafted HTTP request sent to the subscriber endpoint of the plugin. Remediation is critical to prevent data leakage or unauthorized data modification.
