Unauthenticated SQL Injection in the Nikstore Core plugin allows an attacker who can trigger the vulnerable code to inject arbitrary SQL commands into the database. The flaw exists in all releases up to and including version 1.5. Once exploited, an attacker can read, modify, delete, or create data, potentially leading to full compromise of the WordPress site and exposure of sensitive information. The weakness is a classic input validation flaw, categorized as CWE-89. The technical description: the plugin fails to sanitize user input before inclusion in SQL queries.

The vulnerability affects the Nikstore Core plugin distributed by TeconceTheme for WordPress. All versions up to and including 1.5 are vulnerable. Site administrators using these versions should verify the plugin version and upgrade or remove it.

The CVSS score of 9.3 indicates a critical severity. The attack vector is remote and unauthenticated, inferred from the description that the vulnerability can be triggered by any user who can access the plugin’s interface. Thus, anyone who can invoke the vulnerable code can exploit it. The EPSS score of < 1% indicates a very low but non-zero exploitation probability, and the absence of a KEV listing does not reduce the inherent risk. An attacker could execute arbitrary SQL commands with the privileges of the WordPress database user, potentially compromising the entire site.