This vulnerability (CVE-2024-35630) in LJ Apps WP TripAdvisor Review Slider is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It allows blind SQL injection attacks, which can be exploited remotely over the network by an attacker with high privileges and no user interaction. The vulnerability affects all versions up to 12.6. The CVSS 3.1 base score is 7.6, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation is currently documented.

An attacker with high privileges can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity of data is not impacted, but availability may be slightly affected. This could compromise the confidentiality of the affected system's database contents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin to trusted users only and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted networks or users with high privileges. Follow vendor channels for updates on patches or mitigations.