The Vulnerability in the Testimonials by BestWebSoft WordPress plugin allows attackers to inject arbitrary SQL code through the unfiltered 'offset' parameter. An unauthenticated attacker can manipulate the SQL query, potentially retrieving sensitive data, modifying stored entries, or defacing the site. The exploit does not require elevated privileges, meaning any web user can trigger it, leading to data confidentiality, integrity, or availability compromise.

The vulnerability exists in the Testimonials by BestWebSoft plugin versions 1.0.5 to 1.0.8 installed on WordPress sites. These plugin versions have not been updated to address the SQL injection flaw.

The CVSS score of 6.8 indicates a moderate to high severity. Because the flaw is unauthenticated, an attacker can exploit it simply by accessing the plugin endpoint from the internet. EPSS is not available, and the issue is not currently listed in the CISA KEV catalog, but the lack of authentication combined with the potential for data exfiltration means the risk is non‑negligible.