This vulnerability in VibeThemes WPLMS (versions before 1.9.9.5.3) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. The vulnerability allows an attacker with high privileges to execute crafted SQL commands that could compromise data confidentiality and affect system availability. No official patch or vendor advisory details are currently available.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or manipulate sensitive data, potentially leading to data confidentiality breaches and partial denial of service. The vulnerability does not affect integrity according to the CVSS vector. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the WPLMS plugin and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted networks where possible.