The vulnerability is a blind SQL injection arising from improper sanitization of user‑supplied input that is incorporated into an SQL query. An attacker who can trigger the vulnerable code could manipulate the query structure to extract, modify, or delete database contents, potentially gaining unauthorized access to sensitive data or compromising site integrity. The weakness is identified as CWE‑89, a classic injection flaw that compromises confidentiality and integrity of the database.

WordPress installations that have the halfdata Green Popups plugin installed at a version earlier than 7.6.3 are impacted. The vulnerability affects all sites running the plugin regardless of other plugins or themes, assuming the plugin code is active and accessible.

The CVSS score of 9.3 marks this flaw as Critical, indicating that successful exploitation could lead to significant damage. The EPSS score of < 1% indicates a very low likelihood of exploitation. Based on the description, the likely attack vector is through the plugin’s public or administrative interface, requiring the attacker to supply crafted input that is included in an SQL statement. The vulnerability is a blind injection; thus, an attacker may need to infer data through response timing or error messages. No additional conditions beyond the presence of the vulnerable plugin version are specified.