The BSK PDF Manager WordPress plugin up to version 3.8.1 fails to properly validate and escape a shortcode attribute named tags_specific. This flaw allows an attacker who is authenticated with contributor level access or higher to inject arbitrary SQL into backend queries. Successful exploitation would enable the attacker to read sensitive data from the database, including administrator password hashes, potentially leading to credential compromise and broader system compromise.

WordPress sites using the BSK PDF Manager plugin version 3.8.1 or earlier are vulnerable. The issue exists in the plugin’s handling of the tags_specific shortcode attribute and affects all installations using that or earlier plugin releases.

Because the vulnerability requires authenticated access with contributor privileges, the attack surface is limited to users who have logged in to the WordPress admin area. The lack of an EPSS score means current exploitation probability is unknown, but the potential to extract password hashes makes the impact severe. The CVE is not listed in CISA’s KEV catalog, yet the exploitation of this flaw would still allow privilege escalation and data leakage. In the absence of a publicly available patch, the risk remains high until a newer plugin version is applied or the parameter handling is corrected.