This CVE presents a textbook case of the CVSS-EPSS gap that should make you rethink how you prioritize incident response. The vulnerability is an unauthenticated SQL injection in RealPress (a WordPress real estate plugin) with a 9.3 CVSS base score — technically severe, no question. But the EPSS probability sits at just 0.29%, meaning there's roughly a one-in-three-hundred chance of active exploitation in the next 30 days. That's a gap worth interrogating.
The easy answer is to treat CVSS as a proxy for urgency and move on. Don't. The more useful frame is understanding why this gap exists and what it actually tells you.
The EPSS number reflects mass-scanning economics — automated tools looking for easy targets at scale. RealPress is a niche plugin with limited deployment, which explains the low probability. But here's the critical wrinkle this CVE exposes: when software reaches end-of-life, the probability model breaks down entirely. RealPress <= 1.1.2 is deprecated — there's a 1.1.3 with a fix, meaning anyone still running the vulnerable version is running abandoned code that will never receive patches through normal channels.
That changes the risk calculus in two ways. First, abandoned plugins stop generating threat intel because nobody's watching them — the 0.29% EPSS may reflect not safety, but invisibility. Second, abandoned software is exactly what targeted attackers catalog for later use. The probability model can't measure a motivated actor with a list of RealPress installations pulling real estate transaction data and agent PII — that's not in the EPSS training data because it doesn't scale.
What you should do: treat this as a different urgency, not lower urgency. Identify whether RealPress exists in your environment at all — many organizations lack inventory visibility into deprecated plugins. If you find it, patch or virtual-patch it. The blast radius of a SQLi in real estate software (property listings, agent contacts, financial references) is real even if mass exploitation is unlikely. The right response matches the blast radius, not the probability.
The broader lesson is that high CVSS scores and low EPSS scores in tandem should trigger this specific line of questioning: is this deprecated, niche, or both? Those conditions invalidate the probability model's assumptions, and that's when your triage logic needs to shift from statistical urgency to asset-specific risk assessment.