A user–supplied input to the Easy Pricing Tables plugin on WordPress can be manipulated to inject arbitrary SQL code. This flaw, classified as CWE-89, allows a malicious actor to read, modify, or delete database records, thereby compromising the confidentiality and integrity of site data. The vulnerability is accessible to any contributor or visitor that can reach the plugin’s input endpoints. No special knowledge of the site is required beyond normal web access.

The bug affects installations of the Fatcatapps Easy Pricing Tables plugin for WordPress running version 4.1.2 or older. Any WordPress site that has not upgraded to version 4.1.3 or higher remains susceptible.

The flaw carries a high CVSS score of 8.5, demonstrating significant potential impact. The vulnerability is not listed in the CISA KEV catalog, and the nature of the attack indicates that the exploitation vector is web‑based, typically via the plugin’s publicly exposed APIs or administrative forms. The attack does not require elevated privileges on the target, meaning a remote attacker can activate the SQL injection simply by sending crafted requests to the vulnerable endpoint.