Unauthenticated SQL Injection is present in the WordPress Library Management System plugin versions up to 3.5.7, allowing an attacker to inject arbitrary SQL statements into database queries. This flaw can lead to data exfiltration, corruption, or full compromise of the library database, as the attacker can execute any SQL command without authentication.

The vulnerability impacts the Online Web Tutor: Library Management System plugin for WordPress. Any instance of the plugin with a major or minor version up to and including 3.5.7 is affected, regardless of site configuration.

With a CVSS score of 9.3, the vulnerability is classified as high severity. The EPSS score is not available, so the actual exploitation likelihood remains uncertain. The flaw is not listed in CISA KEV. The attack vector is inferred to be unauthenticated, likely via exposed plugin endpoints that accept user-supplied parameters; once exploitation succeeds, an attacker can run any SQL command and compromise the entire library database.