The BSK PDF Manager WordPress plugin through version 3.8.1 does not properly sanitize the tags_specific shortcode attribute before using it in a SQL statement. This flaw allows an authenticated user with contributor-level access or higher to inject arbitrary SQL. Successful exploitation can retrieve sensitive database data, including administrator password hashes, effectively compromising credential confidentiality and potentially enabling broader system compromise.

WordPress installations that are running the BSK PDF Manager plugin version 3.8.1 or earlier are vulnerable. The issue resides in the handling of the tags_specific shortcode attribute and applies to any WordPress site where the plugin is active.

The vulnerability requires authentication, limiting the attack surface to users who have logged into the WordPress admin area with contributor rights or higher. The CVSS score of 6.8 categorizes it as moderate severity, while the EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation in the wild. The potential to extract administrator password hashes elevates the risk, yet the flaw is not listed in CISA’s KEV catalog. Until a patched version or a corrective measure is applied, the risk remains high for affected sites.