This vulnerability in the wp-buy Limit Login Attempts plugin (versions <= 5.5) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The issue allows remote attackers with no privileges and no user interaction to execute crafted SQL commands, potentially compromising confidentiality and causing limited availability impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed with high confidentiality impact and low availability impact. No patch or official remediation guidance is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and may cause limited disruption of service (low availability impact). The vulnerability does not require authentication or user interaction, increasing its risk. However, no known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to mitigate risk. Monitor for updates from the vendor or trusted security sources regarding patches or workarounds.