The Navayan CSV Export plugin suffers from an SQL Injection vulnerability (CVE-2024-55988) caused by improper neutralization of special elements in SQL commands. This allows an unauthenticated attacker to conduct Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information. The vulnerability affects all versions up to 1.0.9. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. No vendor advisory or patch links are currently available.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive data from the backend database without authentication. The confidentiality impact is high, while integrity is not affected and availability impact is low. This could lead to significant data leakage from affected systems running vulnerable versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Navayan CSV Export plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.