An attacker can exploit an SQL injection flaw that allows blind extraction of data from the database. The vulnerability arises from improper neutralization of special elements used in an SQL command within the WordPress Business Directory plugin. If successfully leveraged, the attacker can read, modify, or delete sensitive data stored in the database, potentially affecting site integrity and confidentiality.

The vulnerability affects the WPTasty Business Directory plugin for WordPress, specifically versions up to and including 6.4.27. No lower bound is listed, so any installation of the plugin within that range is potentially impacted.

The CVSS score of 7.6 indicates a high severity risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface where unauthenticated or authenticated users can submit crafted input; this inference is drawn from the nature of SQL injection attacks. Exploitation requires access to the web form or administration panel that accepts user-supplied data that is not properly sanitized.