The averta Depicter — Popup & Slider Builder plugin for WordPress suffers from a generic SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper preparation of the 's' parameter in SQL queries. This flaw allows unauthenticated remote attackers to inject additional SQL commands, potentially exposing sensitive database information. The vulnerability affects all plugin versions up to and including 3.6.1. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild or official patches have been documented yet.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database by injecting arbitrary SQL commands through the vulnerable 's' parameter. The confidentiality of the data is at risk, but integrity and availability are not impacted according to the CVSS vector. This could lead to data leakage and potential exposure of sensitive site or user information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.