The vulnerability, identified as a Subscriber SQL injection in versions of the WordPress SALESmanago & Leadoo plugin up to 3.11.2, allows an unauthenticated user to send crafted input that is incorrectly incorporated into SQL statements. This leads to arbitrary SQL execution against the site's database, exposing confidential data, enabling data modification, and potentially compromising the integrity of the application. The weakness is a classic Injection flaw, categorized as CWE‑89.

The issue affects installations of the SALESmanago & Leadoo WordPress plugin from any company that has the plugin in a version equal to or older than 3.11.2. No particular environment configuration is specified; any site running the affected plugin is at risk regardless of its other host settings.

With a CVSS score of 8.5, the vulnerability is considered high impact. The EPSS score is not available, so the current exploitation probability cannot be quantified, but given the common nature of SQL injection in web applications and the lack of known mitigations, the risk of exploitation remains significant. The plugin processes input from plugin URLs or form submissions, so an attacker can supply malicious payloads remotely. The vulnerability is not yet in the CISA KEV catalog, indicating no widespread documented exploitation as of now.