Unauthenticated users can exploit a SQL Injection flaw in the WordPress 결제 심플페이 plugin versions 5.5.6 and earlier. The vulnerability allows arbitrary SQL statements to be executed, enabling attackers to read, modify, or delete database records, which can result in exposure of sensitive information, defacement, or data loss. This weakness is identified as CWE-89.

The flaw affects the WordPress 결제 심플페이 plugin from codemstory, specifically all releases up to and including version 5.5.6. Sites running these versions are vulnerable.

The CVSS score of 9.3 marks the issue as critical. Because the injection is unauthenticated, an attacker only needs to access the plugin’s endpoint; no privileged credentials are required. While no EPSS data is available, the absence of KEV listing does not lower the risk, as the exploitation path is straightforward over standard HTTP/HTTPS traffic. An attacker could fully compromise the database if the vulnerability is not patched.