The Recordbrowser WordPress plugin, up to version 1.1.7, fails to properly sanitize a "recordid" parameter before incorporating it into an SQL query. This flaw permits an attacker to inject arbitrary SQL commands, enabling unauthorized extraction of sensitive database information without needing authentication. The data exposed could include user credentials, site content, and other confidential data stored in the WordPress database, thereby compromising confidentiality and potentially integrity.

This vulnerability affects the Recordbrowser plugin manufactured by Unknown:Recordbrowser and applies to all installations running any version of the plugin 1.1.7 or earlier. The plugin is typically installed on WordPress sites, but the CVE data does not specify additional vendor or product details beyond the plugin itself.

The CVSS score of 8.6 indicates high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so there is no publicly reported exploitation data. However, because the flaw is unauthenticated and allows direct SQL injection, the risk of exploitation is high for any site exposing the plugin to the internet. Based on the description, it is inferred that attackers can exploit the flaw via simple HTTP requests to the plugin endpoint that accepts the "recordid" parameter, without requiring any credentials or additional conditions.