An improper neutralization of special elements in SQL commands (CWE‑89) allows an attacker to inject arbitrary SQL into the YMC Filter WordPress plugin’s query handling. The flaw can be exploited to read, modify, or delete data that the plugin’s database user can access. The risk is limited to the scope of the database permissions granted to the plugin; no further capabilities such as code execution are documented by the vulnerability description.

All WordPress sites that have the YMC Filter plugin installed in a version from its initial release through 3.11.5 are affected. The plugin is offered by YMC and adds filtering and grid display features to WordPress installations. Users running any of these versions host the vulnerable code and are susceptible to exploitation.

The CVSS score of 9.3 marks this as a critical vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is via the web, with an attacker posting crafted input to a form or URL that the plugin processes. Successful exploitation requires only the ability to send a request to the site; no additional privileges are needed to trigger the injection.