The vulnerability allows an authenticated administrator to inject arbitrary SQL statements into the plugin's backend. An attacker who exploits this flaw can read, modify, or delete database records, potentially compromising confidential data, altering site content, or escalating privileges. The weakness is a classic injection flaw (CWE-89).

WordPress sites using the Melapress Admin Notices Manager plugin 1.6.0 or earlier are affected. No specific operating system or WordPress version is limited; the vulnerability resides in the plugin code itself.

The CVSS score of 7.6 indicates a high risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need administrative access to the WordPress backend to execute the injected queries, making the attack vector an authenticated web interface.