The Library Management System – Manage e-Digital Books Library plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) via the 'owt7_borrow_books_id' parameter in versions up to 3.2.0. Insufficient escaping and lack of prepared statements allow authenticated users with low privileges (Subscriber and above) to append malicious SQL code to existing queries. This can be exploited to extract sensitive information from the backend database. The vulnerability is network exploitable with low attack complexity and no user interaction required. Integrity and availability are not impacted, but confidentiality is compromised. No patch or official fix has been documented yet.

An attacker with Subscriber-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect data integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to the 'owt7_borrow_books_id' parameter. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official fix.