This vulnerability in WPChill Download Monitor (up to version 4.9.4) is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) shows that exploitation requires network access with low attack complexity but high privileges, no user interaction, and results in high confidentiality impact with limited availability impact. No official patch or vendor advisory detailing remediation is currently available.

An attacker with high privileges on the system could exploit this vulnerability to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to trusted administrators only and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted networks or users with elevated privileges.