The Boost plugin for WordPress contains a time‑based SQL injection flaw in the current_url and user_name parameters. Unsanitized user input is concatenated into SQL statements without proper escaping, allowing an unauthenticated attacker to inject additional SQL queries that can retrieve sensitive data from the WordPress database. This vulnerability can lead to the disclosure of user credentials, site content, and other confidential data. The weakness is an instance of CWE‑89, a classic SQL injection flaw.

Vendors and products affected are PixelYourSite Boost versions 2.0.3 and earlier. No further version details are listed, so any deployment of Boost 2.0.3 or any earlier snapshot is vulnerable.

The CVSS score of 7.5 indicates a high severity of this defect, and no EPSS score is available. The vulnerability is not yet listed in the CISA KEV catalog, so no confirmed exploitation campaigns are reported. An attacker can exploit the flaw remotely by sending crafted requests containing SQL payloads in the current_url or user_name parameters without needing authentication. The lack of access control and input validation makes the attack straightforward for anyone who can reach the affected plugin’s endpoints.