This vulnerability in PickPlugins Wishlist plugin (versions up to 1.0.41) involves improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability could allow an attacker to execute crafted SQL commands, potentially exposing sensitive data or causing service disruption.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute SQL commands that may lead to partial denial of service and compromise confidentiality of data handled by the Wishlist plugin. Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to SQL queries. Avoid using affected versions in production environments where possible.