This vulnerability involves improper neutralization of special elements used in SQL commands within the Backup and Staging by WP Time Capsule WordPress plugin (revmakx). It allows an attacker with low privileges and no user interaction to perform SQL Injection attacks, potentially leading to high confidentiality impact and low availability impact. The affected versions are up to and including 1.22.21. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial scope impact.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited denial of service (low availability impact). There is no indication of integrity compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin functionality to trusted users only and monitor for unusual activity related to SQL queries. Avoid using affected versions if possible.