A classic SQL injection flaw exists in the nicen-localize‑image WordPress plugin for versions up to 1.4.9. The plugin fails to properly sanitize or validate user‑supplied input before incorporating it into SQL statements, giving an attacker the ability to inject arbitrary SQL. This CWE‑89 weakness can lead to unauthorized read, modification, or deletion of database content, thereby compromising confidentiality and integrity of site data.

Any WordPress site that installs nicen‑localize‑image version 1.4.9 or earlier is affected. The vendor 友人a丶 has not published a detailed version matrix beyond stating that releases through 1.4.9 are vulnerable, so all releases up to that point should be treated as at risk.

The CVSS score of 8.5 classifies this as a high‑severity vulnerability while the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the plugin’s web interface or any crafted HTTP request that reaches its input endpoints, which the plugin processes without proper input filtering. An attacker could send malicious requests that manipulate the SQL statement, thereby gaining unauthenticated access to the database.