The Small Package Quotes – UPS Edition plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) via the 'edit_id' parameter in versions up to 4.5.16. The vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query involving this parameter. An unauthenticated attacker can append malicious SQL code to the query, potentially extracting sensitive data from the backend database. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but no patch or remediation guidance is currently available from the vendor.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not directly impact integrity or availability but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to prevent exploitation. Monitoring for updates from the vendor is recommended.