The BuildKit WordPress plugin before 1.0.29 fails to sanitize and escape data submitted by contributor‑level users. The list_content parameter is stored directly and later incorporated into a database query without proper escaping. A malicious contributor can inject SQL that executes when the stored content is published and viewed by any visitor, potentially exposing, modifying, or deleting data in the site database.

Any WordPress installation using the BuildKit plugin version earlier than 1.0.29 is affected. The vulnerability exists in the plugin code managing the list_content field and requires that a user has the Contributor role.

Because the flaw is a stored SQL injection, exploitation requires the attacker to have contributor privileges, which is a relatively low‑privilege level commonly granted for content authors. Once injected, the associated SQL runs with the privileges of the web application’s database user. While no publicly reported exploit is referenced in the CVE description, it cannot be ruled out that attackers may target this flaw. The EPSS score is below 1%, indicating a very low but non‑zero perceived exploitation probability, and the KEV designation is absent, suggesting no known exploitation in the CISA catalog. The CVSS score of 6.2 reflects medium severity, but the potential impact remains significant, especially in environments with sensitive data, because unauthenticated visitors can trigger the injected SQL when viewing the published content.