The vulnerability CVE-2024-56047 in VibeThemes WPLMS plugin (versions before 1.9.9.5.3) is an SQL Injection issue caused by improper neutralization of special elements in SQL commands. This allows an attacker with low privileges to execute crafted SQL commands that can compromise data confidentiality and cause partial denial of service. The CVSS 3.1 score is 8.5, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and scope change. No official patch or vendor advisory is currently available.

Successful exploitation can lead to partial denial of service and disclosure of confidential information due to SQL Injection. The attacker requires low privileges and no user interaction, increasing the risk. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users with low privileges.