The vulnerability is a classic SQL injection flaw in the editor module of the Ultimeter plugin for WordPress, which allows an attacker to inject arbitrary SQL statements into the database. If exploited, the attacker can read, modify, or delete data stored by WordPress, potentially leading to data theft, site defacement, or privilege escalation. In the worst case, the attacker might achieve remote code execution on the application server if the database interaction enables arbitrary code triggers.

WordPress sites running the Ultimeter plugin by Ben Roberts, versions up to and including 3.0.8 are impacted; any site using these versions is subject to the described weakness.

The CVSS score of 7.6 indicates a high severity level, and although an official EPSS score is unavailable, the absence from CISA’s KEV catalog does not diminish the risk. Likely, the attacker must have some level of access to the plugin’s editor interface—typically an authenticated user with editing rights—to insert malicious payloads. Once authenticated, an attacker can execute arbitrary SQL, which provides a substantial threat to confidentiality, integrity, and potentially availability of the WordPress database.