This vulnerability allows an attacker to inject arbitrary SQL commands into the Church Admin plugin for WordPress without requiring authentication. The flaw falls under CWE‑89 and can lead to data exfiltration, unauthorized data modification, or even escalation to higher privileges if the database contains sensitive information or is exposed to wider networks.

The affected product is the Church Admin WordPress plugin developed by andy_moyle. Versions up to and including 5.1.1 are impacted. Any WordPress installation that has the plugin version 5.1.1 or earlier is susceptible.

The issue carries a CVSS score of 9.3, indicating a critical level of risk. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires only an unauthenticated HTTP request to a vulnerable endpoint provided by the plugin, making the attack vector straightforward and highly likely to be leveraged by adversaries.