The vulnerability is an improper neutralization of special elements in an SQL command, allowing a blind SQL injection into the ProfileGrid plugin. An attacker could manipulate input parameters to extract database information, such as user credentials, or modify the database content. The flaw is identified as a CWE‑89 SQL injection weakness.

The issue affects the WordPress ProfileGrid user profiles, groups and communities plugin developed by Metagauss, in all versions up to and including 6.0.0.2. The plugin is commonly installed on WordPress sites that rely on user profile grids and community features.

The CVSS score of 8.5 indicates high severity. Exploitation requires sending crafted requests to the plugin’s endpoints, and the attack vector is inferred from the description to be via web requests targeting those endpoints. Because the attack is blind, successful exploitation may therefore take longer, but the lack of evident protection and the absence of an available patch at the time mean that attackers could still use automated SQL injection testing tools. The EPSS score is not available, and the vulnerability is currently not listed in the CISA KEV catalog, yet the high CVSS warrants urgent remediation.