This vulnerability in VibeThemes VibeBP (versions before 1.9.9.7.7) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score of 9.3 reflects that an unauthenticated attacker can remotely exploit this vulnerability with low attack complexity, causing a complete confidentiality breach and limited availability impact. No vendor advisory or patch information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system, potentially leading to full disclosure of sensitive data (confidentiality impact is high). The integrity impact is not indicated, and availability impact is low. This could compromise the security of the affected VibeBP installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented in the provided data.