The Cost Calculator Builder PRO plugin for WordPress suffers from a blind time-based SQL Injection vulnerability via the 'data' parameter due to improper neutralization of special elements in SQL commands (CWE-89). This flaw allows unauthenticated remote attackers to inject additional SQL queries by exploiting insufficient escaping and lack of prepared statements in the plugin's handling of user input. The vulnerability affects all versions up to 3.2.15 and has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the backend database. The vulnerability does not impact integrity or availability but compromises confidentiality. Since the attack can be performed by unauthenticated attackers remotely, it poses a significant risk to affected WordPress sites using the vulnerable plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Cost Calculator Builder PRO plugin or restricting access to the vulnerable functionality to trusted users only. Monitor the vendor's channels for updates or patches addressing this vulnerability.