The iNET Webkit 1.2.4 WordPress plugin contains an unsanitized input field in its contributor feature, creating a classic SQL Injection flaw (CWE-89). Attackers can inject arbitrary SQL statements into the plugin’s database queries, allowing them to read, modify This site content and disrupt data integrity.

WordPress sites that have installed the iNET Webkit plugin, version 1.2.4, are affected. The vulnerability applies only to the contributor component of the plugin; sites that do not not impacted.

The vulnerability exists in the contributor feature of the iNET Webkit plugin version 1.2.4 for WordPress. An attacker can send specially crafted HTTP requests to the contributor endpoint containing malicious SQL that is not properly sanitized, resulting in a classic SQL injection flaw (CWE‑89). Abuse of this flaw allows the attacker to read or modify data stored in the WordPress database, potentially compromising all content and site integrity. The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests exploitation events are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the risk of database compromise remains significant for affected installations.