This vulnerability allows an attacker to inject SQL statements into the database through unsanitized input in the WP w3all phpBB plugin, potentially resulting in data exfiltration, modification, or deletion. The affected code uses direct database queries without proper parameterization, which is a classic instance of CWE-89. Successful exploitation could compromise the confidentiality and integrity of the website’s data, and in some configurations may lead to denial of service or unauthorized admin access.

The flaw affects installations of the WP w3all phpBB plugin for WordPress with versions up to and including 3.0.5. Administrators running these versions on any WordPress site are vulnerable; newer versions (3.0.6 and above) contain the fix.

The CVSS score of 8.5 classifies this as a high‑severity issue. The EPSS score is not available, but the lack of a KEV listing does not preclude active exploitation; many WordPress plugins are widely deployed and often targeted. The attack vector is likely through a publicly accessible URL that accepts the vulnerable input field, making the vulnerability reachable over the network from any host that can reach the target site.