The vulnerability is a classic SQL Injection flaw in WordPress WP All Import plugin versions up to 4.0.1, classified as CWE‑89. When triggered by an authenticated administrator, an attacker can inject arbitrary SQL statements, potentially leading to data exfiltration or the execution of privileged code within the WordPress database context.

The affected product is the WordPress WP All Import plugin. Versions 4.0.1 and earlier are susceptible. Administrators managing WordPress sites that use these plugin versions are at risk.

The CVSS score is 7.6, indicating a medium‑high severity. The EPSS score is not available, so historical exploitation data is unknown at this time. The vulnerability has not been listed in CISA KEV, suggesting no widespread known exploits. Exploitation requires administrator privileges on the WordPress site; once achieved, an attacker can execute arbitrary SQL commands in the database context and potentially compromise the entire site.