The WP-Partner WordPress plugin version 1.2.1 and earlier accepts an "id" parameter without sanitisation or escaping before using it in a SQL query. This oversight permits an unauthenticated attacker to append additional SQL statements, directly accessing sensitive database contents and implicitly compromising data confidentiality.

WordPress sites running the WP‑Partner plugin at or below version 1.2.1. The vulnerability exists regardless of other plugins or themes because it is isolated within WP‑Partner’s own database access calls.

An EPSS score of <1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, but the CVSS score of 8.6 classifies it as high severity, and the nature of unauthenticated SQL injection makes it inherently high‑risk: any user can craft a request to the vulnerable endpoint and harvest database information. The absence of authentication checks, combined with the lack of input filtering, indicates that exploitation requires only a public web request and does not depend on privileged access or special environmental conditions.