This vulnerability in the WP Yelp Review Slider plugin arises from improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. It affects all versions up to 8.1. The CVSS score of 7.6 reflects a network attack vector with low attack complexity, requiring high privileges but no user interaction. The impact is high on confidentiality and low on availability, with no integrity impact. No patch or vendor advisory is available at this time.

An attacker with high privileges can exploit this vulnerability to perform blind SQL injection, potentially extracting sensitive data from the database (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (low availability impact). No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users. Do not rely on generic mitigations as the vendor has not provided specific guidance.