The WP Simple Pay Lite Manager plugin for WordPress, up to version 1.4, contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with high privileges and no user interaction required to execute crafted SQL commands, potentially exposing sensitive data and causing partial service disruption. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information (confidentiality impact) and partial disruption of service (availability impact). Integrity is not affected. The attacker must have high privileges on the system, which limits the scope of exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to high-privilege accounts and consider limiting exposure of the affected plugin to trusted users only.