The Gboy Custom Google Map plugin (<= 1.2) suffers from a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with low privileges and no user interaction to execute crafted SQL queries remotely over the network, potentially exposing sensitive data and causing partial service disruption. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (confidentiality impact) and limited denial of service (availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely by an attacker with low privileges without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected plugin, apply web application firewall (WAF) rules to detect and block SQL injection attempts, and limit privileges of accounts interacting with the plugin to reduce potential impact.