The WPExperts.io WP Multistore Locator plugin suffers from an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability. This allows remote attackers to inject malicious SQL queries without authentication, potentially exposing sensitive information. The vulnerability affects all versions up to 2.5.1. The CVSS v3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented yet.

Successful exploitation could allow an attacker to extract sensitive data from the backend database without authentication, compromising confidentiality. The vulnerability does not impact data integrity or availability directly. Given the critical CVSS score and the nature of Blind SQL Injection, this poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WP Multistore Locator plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.