The vulnerability CVE-2024-56042 in VibeThemes WPLMS plugin arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. This affects all versions before 1.9.9.5.3. The CVSS 3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction needed, and a scope change. The impact includes high confidentiality loss and low availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.