The Askeet WordPress plugin is susceptible to SQL Injection through its 'sql_query' parameter within multiple AJAX endpoints. The flaw originates from an insufficient input filter that can be bypassed with MySQL conditional comments. An attacker with Administrator privileges can inject additional queries to read or manipulate database contents. This vulnerability carries a CVSS score of 4.9, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.

Vendors and products affected are 2wstechnologies' Askeet plugin for WordPress, in all releases up to and including version 3.0. Administrators and users with higher privileges on sites running this plugin are at risk.

The attack likely involves an authenticated user sending a crafted 'sql_query' payload to the vulnerable AJAX endpoints. The use of MySQL conditional comments undermines the plugin's safe-query filter, enabling the injection of UNION or other statements that can exfiltrate data. While the CVSS rating suggests moderate risk, the lack of exploitation evidence (EPSS not available) and absence from the KEV list imply that widespread exploitation is not yet documented, but the vulnerability remains actionable for high‑privilege users.