This vulnerability involves improper neutralization of special elements in SQL commands within the reza19 Download-Mirror-Counter plugin for WordPress, allowing SQL Injection attacks. It affects all versions up to 1.1. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with integrity not affected. No official patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The availability impact is low, and integrity is not impacted according to the CVSS vector. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the vulnerable plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users or networks.