This vulnerability is an unauthenticated SQL injection flaw in the WordPress Quotes llama plugin version 3.1.5 and earlier. An attacker can inject arbitrary SQL statements through the plugin’s input fields, potentially allowing them to read, modify, or delete data stored in the WordPress database. The lack of authentication makes it possible for any user to exploit the flaw, leading to loss of confidentiality, integrity, or availability of site data.

The flaw impacts the Quotes llama plugin developed by oooorgle, used on WordPress sites. All installations with plugin versions 3.1.5 or earlier are affected.

With a CVSS score of 9.3, this issue is critically severe. The EPSS score of 1% indicates a low but measurable risk of exploitation. The lack of authentication requirement and the widespread use of WordPress point to a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the ability to access the site’s database unauthenticated provides a clear attacker path. The likely attack vector is through crafted HTTP requests targeting the plugin’s input endpoints, which is inferred from the nature of the flaw.