The vulnerability is an administrative‑level SQL Injection in the WordPress Popup box plugin version 6.0.1 and earlier. Because the plugin concatenates unsanitized user input into SQL statements, an attacker with administrative rights could inject arbitrary SQL, potentially accessing or altering sensitive database contents. This flaw falls under CWE‑89.

The affected product is Ays Pro:Popup box, versions up to and including 6.0.1. No other vendors or product variants are listed.

The CVSS score of 7.6 indicates a high severity risk, and while EPSS data is not available, the lack of listing in CISA’s KEV catalog suggests no confirmed field‑wide exploitation yet. The likely attack vector is through the plugin’s administrative interface, requiring the attacker to have WordPress administrative privileges or to compromise an administrative account. Once an attacker gains such access, the injection can lead to data exposure, modification, or potential privilege escalation within the WordPress environment.