The vulnerability in the Estatik WordPress plugin allows an attacker with administrator access to inject arbitrary SQL statements into the database. If exploited, the attacker could read, modify, or delete sensitive data held in the WordPress database, potentially leading to data loss or unauthorized disclosure. The weakness is classic SQL injection, a high-impact flaw that undermines data integrity and confidentiality.

WordPress sites that use the Estatik plugin version 4.3.5 or earlier are affected. The issue is specific to the Estatik plugin and does not extend to other plugins or the core WordPress software.

The CVSS score of 7.6 categorizes this flaw as high severity. EPSS is not available, so the current probability of exploitation is unclear, and it is not listed in the CISA KEV catalog. The likely attack vector involves the web interface and requires an authenticated administrator to craft a malicious input to the plugin’s backend. Successful exploitation would allow the attacker to compromise the site’s database data potential.