The FULL – Cliente plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements on the 'formId' parameter in versions 3.1.5 through 3.1.25. Authenticated attackers with Subscriber-level privileges or above can exploit this flaw to inject additional SQL queries, potentially extracting sensitive data from the database. Exploitation is conditional on the PRO version of the plugin being activated alongside Elementor Pro and Elementor CRM plugins. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacting confidentiality.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to perform SQL Injection attacks, enabling unauthorized disclosure of sensitive information stored in the database. The vulnerability does not affect availability or integrity based on current data. Exploitation requires specific plugin configurations (PRO version plus Elementor Pro and Elementor CRM). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin activation to trusted administrators and consider limiting Subscriber-level access where possible. Monitor for updates from the FULL – Cliente plugin vendor and apply patches promptly once available.