This vulnerability in WpIndeed Ultimate Learning Pro (<= 3.9) is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability allows an attacker with high privileges to execute crafted SQL commands that could compromise database confidentiality. No patch or official remediation level has been published yet.

Successful exploitation could lead to unauthorized disclosure of sensitive database information due to SQL Injection. The confidentiality impact is high, but integrity is not affected, and availability impact is low. Exploitation requires high privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the affected application and monitor for unusual database query activity. Avoid exposing the vulnerable version in untrusted environments.