The Llavero.io WordPress plugin through version 0.1.4 fails to sanitize or escape the 'cill_login' parameter before building a SQL query. This flaw allows attackers who are not authenticated to inject SQL code and read data from the database. The formal description states that data can be retrieved, and the CVE title indicates that the injection likely operates via a blind SQL method, inferred from the wording. The consequence is a compromise of database confidentiality that could expose user credentials, site content, or other sensitive information.

WordPress sites that have installed the Llavero.io plugin at version 0.1.4 or older are affected. The vulnerability is limited to the plugin’s handling of the 'cill_login' parameter and does not involve any other WordPress element.

An attacker only needs to send a crafted request to the endpoint that receives the 'cill_login' value; no authentication is required. The EPSS score is reported as <1%, indicating a comparatively low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 8.6 classifies the bug as high severity. Because the vector is open to unauthenticated users, the risk surface is substantial until the vendor releases a patch or the site removes the plugin.