A classic SQL injection vulnerability exists in the nicen-localize-image WordPress plugin in versions up to 1.4.9. The flaw allows an attacker to inject arbitrary SQL statements into the database because the plugin does not properly sanitize or validate user-supplied input before incorporating it into SQL queries. This CWE‑89 weakness can lead to unauthorized reading, modification, or deletion of database contents, potentially exposing or destroying sensitive site data.

Any WordPress site that installs the nicen-localize-image plugin version 1.4.9 or earlier is affected. The vendor, 友人a丶, has not released a comprehensive version matrix beyond the statement that versions up to 1.4.9 are vulnerable, so all releases through that version boundary should be considered at risk.

The CVSS score of 8.5 classifies this as a high‑severity flaw, while the EPSS score of less than 1% indicates a low exploitation probability at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the plugin’s web interface or any crafted HTTP request that reaches its input endpoints, which the plugin processes without proper input filtering. Attackers could exploit the flaw by sending malicious requests that manipulate the SQL statement, thereby gaining unauthenticated access to the database.