The WordPress plugin ASPL Product Quotation, versions up to and including 1.1.0, fails to sanitize the 'quote_id' parameter before incorporating it into SQL queries. This flaw permits unauthenticated attackers to inject arbitrary SQL, giving them read access to any data stored in the plugin’s database tables. The primary consequence is data disclosure; there is no indication of privilege escalation, code execution, or other higher‑level impacts.

This vulnerability affects the ASPL Product Quotation WordPress plugin licensed under Unknown:ASPL Product Quotation. All releases with version numbers 1.1.0 or earlier are vulnerable. No specific sub‑versions are listed beyond the ≤1.1.0 boundary.

The EPSS score is less than 1% and the CVSS score is 8.6, indicating a high severity but low probability of exploitation. The likely attack vector is an unauthenticated HTTP request that contains a malicious 'quote_id' parameter. Because the plugin lacks authentication and input validation, an attacker can likely exploit this flaw to retrieve arbitrary data from the plugin’s database tables, representing a high risk of data disclosure when the plugin is exposed to the internet.