The WP ERP plugin for WordPress, versions up to 1.17.9 contain a flaw that allows unsanitized input to be incorporated directly into SQL queries. This creates an SQL Injection vulnerability that can enable an attacker to read data, modify or delete records, and potentially compromise database integrity. The flaw is identified as CWE-89 and presents a threat to confidentiality and integrity of data stored in the WordPress database. No remote code execution is specified in the CVE data.

The vulnerability is limited to the weDevs WP ERP plugin for WordPress, impacting all releases through version 1.17.9. The plugin is installed on WordPress sites; any site that has the vulnerable plugin version is at risk. The core WordPress application itself is not affected.

The CVSS score of 7.6 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely reported exploitation yet. The flaw is activated by sending operational input to the plugin’s database query functions, likely via HTTP requests that the plugin processes. Based on the description, it is inferred that an attacker could construct malicious SQL statements by interacting with the plugin’s input parameters. The vulnerability requires the plugin to be present and the attacker to have the ability to send crafted input; authentication requirements are unclear from the CVE, so the exact scope depends on the site’s configuration.