This vulnerability in Nks Email Subscription Popup (<= 1.2.23) arises from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The CVSS 3.1 score is 7.6 (High), with network attack vector, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with high privileges to extract sensitive information from the database via Blind SQL Injection, compromising confidentiality. The vulnerability does not impact data integrity but may cause limited availability issues. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and monitor for unusual database queries. Avoid exposing the affected component to untrusted users with high privileges.