The vulnerability is an unsanitized 'attach' parameter in the WordPress plugin WX Subscribe 微信支付付费订阅, allowing unauthenticated attackers to inject arbitrary SQL statements. The flaw permits full read and modify of the database, potentially revealing payment data, user credentials, or enabling further compromise.

The affected component is the WX Subscribe WordPress plugin bundled with Chinese payment service integration, with any installation running version 1.2.1 or earlier. The issue is limited to environments where the payment key configuration is absent, meaning the plugin is still available to external users.

The vulnerability has a CVSS score of 6.8. The flaw can be exploited remotely without authentication, provided the vulnerable parameter is reachable within the site’s public facing URLs. EPSS is <1% and the vulnerability is not listed in CISA KEV, but due to its SQL injection nature and lack of remediation in the affected versions, the risk is high. Successful exploitation would give attackers full database access; no special user privileges are required beyond public access to the site’s frontend.