An attacker can send specially crafted requests to the BuddyBoss Platform plugin without needing any user authentication. The plugin fails to properly escape or validate input before composing SQL queries, allowing the execution of arbitrary SQL statements. This is a CWE-89 flaw that could lead to full data exfiltration, credential theft, or alteration of site content, thereby compromising confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability affects WordPress sites that have the BuddyBoss Platform plugin installed at version 3.0.5 or earlier. The flaw exists in the plugin code that processes user input from the BuddyBoss Platform interface, not in core WordPress.

The CVSS score of 9.3 indicates a high severity, and the EPSS score of less than 1% suggests that actionable exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit this via unauthenticated HTTP requests to, injecting malicious SQL through parameters that are not sanitized.