The dhananjaysingh Multiple Carousel plugin versions up to 2.0 contain an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL code on the affected system without authentication or user interaction. The vulnerability has a CVSS 3.1 base score of 9.3, reflecting critical severity with high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation information is currently provided.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. The vulnerability affects all installations of Multiple Carousel up to version 2.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official vendor channels for updates and apply patches promptly once released.