The WP-Recall plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements on the 'databeat' parameter. This flaw allows unauthenticated attackers to append malicious SQL commands to existing queries, potentially exposing sensitive data from the backend database. The vulnerability affects all plugin versions up to and including 16.26.10. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not affect integrity or availability but poses a significant confidentiality risk. Since no privileges or user interaction are required, the attack surface is broad. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable endpoints as a temporary measure. Monitor for updates from the vendor and apply patches promptly once available.