The Advanced Floating Content plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in the 'floating_content_duplicate_post' function due to improper neutralization of special elements in SQL commands. This allows authenticated attackers with subscriber-level privileges or higher to inject additional SQL queries by exploiting insufficient escaping and lack of prepared statements. The vulnerability affects all versions up to and including 3.8.2. No known exploits are reported in the wild, and no vendor-provided patch or advisory is currently available.

An attacker with subscriber-level or higher access can exploit this vulnerability to append arbitrary SQL queries to existing database queries. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact integrity or availability directly according to the CVSS vector, but confidentiality is rated high. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for unusual database query activity related to the plugin. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if feasible.