This vulnerability arises from the Post Voting System WordPress plugin not properly sanitizing the 'id' query parameter before incorporating it into an SQL statement. The missing validation permits malicious input to be embedded directly in the query, enabling benign users to inject arbitrary SQL commands. The flaw can be exploited to read sensitive data, modify or delete database contents, and in worst‑case scenarios, give an attacker the ability to execute system commands via SQL injection. The weakness aligns with CWE‑89 (SQL Injection).

The affected system is the WordPress plugin known as "Post Voting System", versions 1.0 and earlier. Those installations remain vulnerable; the plugin’s code path handling ‘id’ remains unchanged in these releases. The vector is an unauthenticated web request; any visitor to the site can manipulate the parameter and trigger an injection. No additional authentication or privilege checks are performed before the query is built.

The CVSS score is 8.6, indicating a high severity vulnerability. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog, suggesting it has not yet been observed or exploited in the wild. Nevertheless, the lack of input sanitization and the ability to manipulate SQL statements suggest a high likelihood of exploitation on publicly reachable WordPress sites, especially if this plugin is the sole method of vote handling. Attackers could use this vector to exfiltrate or corrupt data.