The edckwt Quran Shortcode plugin versions up to 1.5 contain an improper neutralization of special elements in SQL commands, resulting in a blind SQL injection vulnerability. This allows an attacker with low privileges and no user interaction to inject SQL commands, potentially compromising data confidentiality and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact.

Successful exploitation could allow an attacker to extract sensitive information from the database (high confidentiality impact) without affecting data integrity, but with some impact on availability. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid using affected versions of the Quran Shortcode plugin if possible.