The CubeWP Framework plugin contains an SQL Injection flaw in the cubewp_remove_relation() AJAX function, where the relation_id parameter is unsafely passed into a raw SQL query. The function uses wp_unslash() to strip backslashes before inserting the value, thereby disabling WordPress’ basic injection protection. This allows an authenticated user with a subscriber role or higher to inject additional SQL statements and potentially read, modify, or delete database contents.

All installations of CubeWP Framework version 1.1.30 and earlier are affected. The vulnerability is present in the plugin code that handles relationship removal via AJAX, and the affected releases are identified by the vendor identifier cubewp1211. Customers using any of these plugin versions on WordPress sites must assess whether their sites include the CubeWP Framework and are therefore vulnerable.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Effective exploitation requires an authenticated attacker with at least subscriber-level access, who can issue the vulnerable AJAX request from a browser session that is logged in to the WordPress site.