This vulnerability (CVE-2024-32136) affects Xenioushk BWL Advanced FAQ Manager through version 2.0.3 and is classified as CWE-89 (SQL Injection). It arises from improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to cause a partial confidentiality breach and low impact on availability. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and scope change with high confidentiality impact and low availability impact. No vendor patch or official remediation level has been published yet.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands that may lead to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the affected application and monitor for unusual activities. Avoid exposing the vulnerable application to untrusted networks where possible.