An attacker can inject arbitrary SQL through inputs that are directly inserted into database queries by the Simple Business Directory Pro plugin. This flaw allows read, write, or delete operations on the entire site database, thereby compromising data confidentiality and integrity. The vulnerability is caused by the absence of proper escaping or parameterization of special characters in SQL statements.

WordPress sites that have installed the Simple Business Directory Pro plugin in a version up to and including 15.9.4 are affected. The plugin, developed by QuantumCloud, is vulnerable from its earliest version through 15.9.4; any site deploying those versions faces this risk.

The CVSS score of 9.3 indicates a critical level of risk. The EPSS score of less than 1% suggests that exploitation is currently unlikely, but possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that external input is embedded directly into SQL statements without proper escaping or parameterization, enabling an attacker to inject malicious SQL. The plugin accepts data from its standard interface, so the attack could potentially originate from unauthenticated or low-privilege users, but the specific privileges required are not defined in the available information.