This vulnerability in the L Squared Hub WP plugin (versions <= 1.0) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and the product is not a cloud service.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The impact includes high confidentiality loss and a low impact on availability (partial denial of service). Integrity is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin functionality and applying any available web application firewall rules that may mitigate SQL Injection attempts.