The Social Web Suite WordPress plugin up to version 4.1.12 fails to require the shared secret before processing authorization requests and does not sanitize a query parameter used in an SQL statement. Unauthenticated users can therefore send crafted requests that result in blind SQL injection, enabling them to read or modify database contents and potentially compromise the confidentiality and integrity of the site.

WordPress sites running the Social Web Suite plugin version 4.1.12 or earlier are affected. The vulnerability exists in the plugin's handling of authentication requests, regardless of the shared secret setting.

Because the flaw is exploitable without authentication and no shared secret is required, any remote user can invoke the vulnerable endpoint. However, the EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and no public exploits have been documented. The CVSS score of 8.6 reflects the high potential impact if the vulnerability is exploited, but the likelihood remains low. The attack vector is inferred to be remote over HTTP(S) due to the WordPress plugin interface. The potential impact includes unauthorized data exfiltration and modification of database contents, compromising confidentiality and integrity. The lack of a KEV listing does not remove the risk.