The vulnerability allows attackers to insert arbitrary SQL statements into subscriber‑related queries within WordPress. This can result in unauthorized reading or modification of the database, potentially exposing sensitive information or altering site data. The weakness is identified as CWE‑89 and is considered a critical threat based on its impact.

WordPress sites that have the If‑So Dynamic Content Personalization plugin installed with version 1.10 or earlier are affected.

The CVSS score of 9.3 classifies the flaw as Critical. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. The CVE description does not specify the exact attack vector, but it references subscriber queries, which suggests that the vulnerability could be triggered by user input submitted to the public subscriber endpoint. This potential exploitation path is inferred from the available information and should be treated as a concern.