Unauthenticated SQL Injection was discovered in the WordPress MDTF Plugin for versions 1.3.7 and earlier. The flaw allows an attacker to inject arbitrary SQL statements into database queries because input is not properly sanitized or parameterized, potentially granting the attacker read, modify or delete access to the WordPress database. This can result in data disclosure, integrity loss, or full compromise of the site’s data.

The affected product is the WordPress MDTF Plugin released by PluginUs.Net. All releases 1.3.7 and older are vulnerable; upgrading to version 1.3.8 or newer is necessary to resolve the issue. The plugin is commonly used in WordPress installations for metadata filtering.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a KEV entry does not reduce the risk. The flaw is unauthenticated, meaning any external user can potentially exploit it by submitting crafted data to the plugin’s interface – although the official description does not specify the exact input paths. Because the plugin is widely deployed, the likelihood of exploitation is considered high.