This vulnerability is an unauthenticated SQL injection flaw in the WordPress WP Data Access plugin versions 5.5.81 and earlier. Attackers can inject malicious SQL statements through the plugin's input fields, granting them read or write access to the underlying database. In the worst case, this could allow modification of site content, extraction of sensitive data, and potentially execution of arbitrary code if the database level grants elevated privileges. The weakness is identified as CWE-89.

The affected component is the WP Data Access plugin for WordPress, developed by Passionate Programmer Peter. Users running version 5.5.81 or earlier are vulnerable. Guides and updates indicate that versions 5.5.82 and later contain the necessary patch.

The CVSS score of 9.3 signals critical severity, and while an EPSS score is currently unavailable, the lack of a KEV listing does not reduce the risk. Because the vulnerability does not require authentication, the likely attack vector is a web request to the plugin's exposed endpoint. The absence of defensive controls means an attacker can exploit it from any network location with access to the site’s frontend.