The Datalist it WordPress plugin up to version 0.0.3 fails to sanitize and escape several request parameters before including them in a SQL query. This omission permits an attacker without authentication to inject arbitrary SQL code, allowing read access to any database table or column that the plugin’s database user can query. The vulnerability directly compromises database confidentiality, as an intruder can extract sensitive information such as user credentials, content, and configuration data.

Vendors of the Datalist it plugin have not defined a CNA, but the affected product is the WordPress plugin Datalist it through version 0.0.3. Any WordPress installation that has this plugin or earlier versions installed is vulnerable. No additional product or platform information is available.

The EPSS score is less than 1% and the CVSS score is 8.6, and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation data. The likely attack vector is a web request to the plugin’s front‑end action endpoint using crafted parameters. Because the flaw enables unauthenticated access to sensitive data, the potential impact is high for confidentiality. No explicit denial of service or privilege escalation is reported, so the attack does not compromise availability or integrity beyond data exfiltration.