The WP Verify API plugin, through version 1.0.0, fails to properly sanitize or escape the value of the 'verify' parameter before it is incorporated into a SQL query. As a result, any user who can access the endpoint can manipulate the parameter to inject arbitrary SQL statements, potentially exposing sensitive data or modifying the database. This flaw is a classic example of SQL injection, enabling attackers to read, change, or delete critical information stored by the application.

WordPress sites that have installed the WP Verify API plugin, specifically versions 1.0.0 or earlier. The vulnerability exists regardless of the website’s user authentication state due to the lack of input validation.

The flaw is exploitable without authentication, allowing an attacker to send malicious requests to the vulnerable endpoint. The EPSS score of <1% indicates a low but measurable probability of exploitation, while the CVSS score of 8.6 classifies the vulnerability as high severity. The issue is not listed in CISA KEV, but the combination of unauthenticated access and significant impact elevates the risk of data compromise or disruption.