The WPExperts.io WP Multistore Locator plugin (version <= 2.5.2) suffers from an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL code without authentication, potentially leading to data exposure and partial service disruption. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with low availability impact. No official patch or vendor advisory is currently referenced.

Successful exploitation of this vulnerability can result in unauthorized disclosure of sensitive information from the underlying database and partial denial of service conditions. The vulnerability does not require authentication or user interaction, increasing its risk. However, no known public exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the WP Multistore Locator plugin or restricting access to it to trusted users only. Monitor official WPExperts.io channels for updates and apply patches promptly once released.