Technical impact
WP Inventory Manager, a WordPress plugin, contains a blind SQL injection flaw where special characters are not properly escaped in an SQL query. An attacker can craft input that is passed directly to the database, allowing extraction of sensitive data or unintended database modification. This flaw can consequently compromise the confidentiality and integrity of the site’s data.
Affected Systems
Any WordPress site that has WP Inventory Manager installed on version 2.4.0 or earlier is vulnerable. The plugin is commonly used for inventory management and is distributed through the WordPress plugin repository.
Risk and Exploitability
The flaw has a CVSS score of 8.5 indicating high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely target the plugin via the web interface, sending crafted input to trigger the blind injection. Once the injection is triggered, the attacker could read or modify the database, potentially leading to data disclosure or site compromise. The likely attack vector is remote via the plugin’s web interface, although the description does not explicitly state it, so this inference is made based on typical web application vulnerabilities.
