This vulnerability in Shahjada WPDM – Premium Packages (<= 6.0.5) is due to improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS 3.1 score is 7.6, indicating a high severity with network attack vector, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is primarily on confidentiality (high) and availability (low), with no integrity impact reported. The vulnerability could allow an attacker with elevated privileges to execute crafted SQL commands that may expose sensitive data or affect service availability.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or disclose sensitive database information, potentially leading to data confidentiality breaches. The vulnerability has a low impact on availability and no impact on data integrity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected plugin and monitor for unusual database activity. Avoid granting unnecessary privileges to users to reduce risk.