This vulnerability in InstaWP Connect (<= 0.1.0.9) involves improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The vulnerability can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and a partial denial of service (low availability impact). There is no indication of integrity impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected InstaWP Connect versions and monitor for unusual activity related to SQL commands. Avoid exposing the vulnerable service to untrusted networks where possible.