The vulnerability in the AFI WordPress plugin arises from improper neutralization of special elements in SQL commands (CWE-89). Specifically, the 'integration_id' parameter is vulnerable to SQL Injection due to insufficient escaping and lack of prepared statements. This enables unauthenticated attackers to append malicious SQL queries to existing ones, potentially leading to injection of arbitrary web scripts that execute upon user interaction. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Successful exploitation can lead to partial disclosure and modification of data via SQL Injection, as well as injection of arbitrary web scripts that may execute in the context of users who interact with crafted links. There is no indication of availability impact. The vulnerability affects all versions up to 1.82.0 of the plugin. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to affected functionality. Avoid clicking on suspicious links that could trigger the vulnerability. Monitor official vendor channels for updates and patches.