The Vitepos lite plugin for WordPress contains an improper neutralization of special elements within a SQL command, a flaw classified as CWE‑89. Attackers can exploit this by injecting malicious SQL fragments into unsanitized input fields, allowing them to issue arbitrary queries through blind SQL injection. The result is potential unauthorized disclosure of database contents, modification of records, and corruption of database integrity.

The plugin is distributed under the appsbd brand and is designed for WordPress sites. Any installation of Vitepos lite with a version number less than or equal to 3.4.2 is affected. The flaw exists regardless of the underlying operating system or PHP version; every WordPress site that has this plugin enabled and has not applied the vendor’s newer release is at risk.

The CVSS score of 8.5 indicates high severity, whereas the EPSS score of less than 1 % suggests that real‑world exploitation rates are currently low and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a web‑based form or request parameter that the plugin accepts and forwards to a database. Because the vulnerability is blind, an attacker must use timing or error‑based techniques, which can be automated with simple tools. The risk remains significant for any site without additional safeguards such as a web application firewall or parameterized queries.