ReactPress allows the creation of TypeORM queries that use HTTP query parameter names directly as SQL column identifiers. Because TypeORM only parameterizes values and not column names, an attacker can craft query string keys that become part of the SQL statement, leading to unauthenticated SQL injection. This flaw can expose, modify, or delete data in the database, compromising confidentiality and integrity of stored content.

The vulnerability affects ReactPress, a publishing system for React developers, in all releases prior to version 3.7.0. The product is distributed by the fecommunity community. 3.7.0 and later incorporate the fix and are no longer vulnerable.

With a CVSS moderate‑high score of 7.5 the flaw is well regarded as significant. The EPSS score is not available and there is no listing in CISA KEV, indicating no confirmed public exploitation to date. Attackers can target the vulnerable API list endpoints via simple HTTP requests without needing authentication, making the attack surface broad. While no exploitation in the wild is confirmed, the potential for data exfiltration or manipulation makes prompt patching advisable.