This vulnerability in WP Grim's Classic Editor and Classic Widgets plugin allows SQL Injection due to improper sanitization of special elements in SQL commands. It affects all versions up to 1.4.1. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted. The scope of the vulnerability is changed, indicating that the attack can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin and monitoring for unusual database activity. Avoid granting unnecessary privileges to users who can interact with the plugin.