This vulnerability involves improper neutralization of special elements in SQL commands within the Lodgix.com Vacation Rental Website Builder plugin (lodgixcom-vacation-rental-listing-management-booking-plugin) versions up to 3.9.73. The flaw allows an attacker with network access and low privileges to perform SQL Injection attacks without user interaction. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact, no integrity impact, and low availability impact. No known exploits are reported in the wild, and no official patch or mitigation guidance has been published by the vendor.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database (high confidentiality impact). Integrity is not impacted, and availability impact is low. The vulnerability requires network access and low privileges but no user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted networks. Follow vendor updates closely for official patches or mitigations.