The Site Setup Wizard WordPress plugin fails to sanitize the email value supplied to the ssw_check_admin_email_exists endpoint before embedding it into a SQL query. This flaw permits attackers who do not need to authenticate to inject arbitrary SQL commands and read the database contents. The compromise can expose user credentials, site content, and configuration data because the plugin operates with the WordPress database user's privileges. The weakness is a classic input validation error (CWE‑89).

Any WordPress site that has the Site Setup Wizard plugin in version 1.5.8 or earlier is affected. The vendor is listed as "unknown" in the advisory, but the CVE confirms that any installation of these plugin versions is vulnerable and requires an update or remediation. Users should verify whether their site runs one of these versions and upgrade accordingly.

The CVSS score of 8.6 classifies the flaw as high severity, and the EPSS score of <1% indicates that exploitation, while possible, is not currently widely observed. The flaw is not included in the CISA KEV catalog. Because no authentication is required, an attacker can trigger the vulnerability simply by sending an HTTP request to the ssw_check_admin_email_exists endpoint with a crafted payload. The resulting data exfiltration could occur over the web interface, making the attack surface remote and easily reachable by anyone who can access the site. The combination of high severity and low observed exploitation probability suggests the risk is significant yet uncertain; however, protection should be applied as soon as possible.