The Tcard WP WordPress plugin up to version 1.8.0 fails to sanitize the group_id parameter before using it in a database query within an unauthenticated AJAX action. This omission allows any visitor to inject arbitrary SQL. Based on the nature of SQL injection, the attacker could read, modify, or delete database contents, potentially exposing sensitive data or compromising the integrity of the site.

Any WordPress installation running Tcard WP 1.8.0 or earlier is vulnerable. The affected component is the AJAX endpoint that consumes the group_id parameter in the plugin.

Because the attack does not require authentication and uses a browser-accessible AJAX URL, it can be remotely executed by an unauthenticated attacker. The CVSS score is 8.6, the EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, the remote and unauthenticated nature of the exploit, coupled with the potential for data exfiltration, results in a high risk if the site hosts sensitive content.