This vulnerability in hiren.sabd's WP Music Player plugin (versions up to 1.3) involves improper neutralization of special elements in SQL commands, leading to SQL Injection. The issue allows an attacker with high privileges to execute crafted SQL commands that can compromise confidentiality and cause partial availability impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. No patch or mitigation details are currently available from the vendor or authoritative sources.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (confidentiality impact) and limited disruption of service (availability impact). Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected plugin to trusted users only and consider disabling the plugin if feasible. Monitor vendor communications for updates on remediation.