The Express Payments Module (up to version 1.1.8) suffers from an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This flaw enables Blind SQL Injection attacks, potentially allowing attackers to extract sensitive information from the backend database without authentication. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and a significant confidentiality impact. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow remote attackers to perform Blind SQL Injection attacks, leading to unauthorized disclosure of sensitive data from the backend database. The vulnerability does not impact integrity but has a low impact on availability. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or restricting access to the vulnerable module to trusted networks only. Monitor vendor communications for updates on patches or mitigations.