This vulnerability involves improper neutralization of special elements in SQL commands within the AmentoTech Workreap theme's plugin, allowing SQL Injection attacks. It affects all versions up to and including 3.3.6. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted users where possible.