The Loja Automática WordPress plugin through version 1.0.0 does not sanitize or escape the supplied ‘id’ parameter before using it in a SQL query. This allows any unauthenticated user to inject arbitrary SQL, potentially reading, modifying, or deleting data from the database. The vulnerability exploits a classic input‑validation weakness, giving attackers direct control over database queries.

All installations of the Loja Automática plugin at version 1.0.0 or earlier are affected. The plugin is delivered as a WordPress add‑on; no vendor or product version beyond the plugin release is specified in the advisory.

The attack does not require authentication or privileged access and can be carried out by any external user simply by sending a crafted request to the vulnerable endpoint. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.6 indicates a high severity, and the combination of unauthenticated access and uncontrolled SQL execution poses a significant risk, with exploitation being straightforward using publicly available SQL injection tools.