This vulnerability in ThimPress LearnPress Export Import (up to version 4.0.3) is classified as CWE-89, indicating improper neutralization of special elements in SQL commands (SQL Injection). The CVSS 3.1 score is 7.6, reflecting a network attack vector with low attack complexity, requiring high privileges but no user interaction. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits are reported in the wild, and no official patch or remediation level has been published by the vendor or Patchstack as of the publication date.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability impact. Since exploitation requires high privileges, the risk is somewhat mitigated by the need for elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin to trusted users only and monitor for unusual activity. Avoid exposing the vulnerable functionality to untrusted users. Follow vendor channels for updates on patches or official mitigations.