A critical SQL Injection vulnerability affects WordPress Short URL plugin versions up to 1.6.8, allowing attackers with subscriber access to execute harmful SQL commands. No patch is available yet. Disable the plugin and apply security measures immediately.