The axiomthemes smart SEO plugin (versions up to 4.0) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This vulnerability allows an attacker with low privileges and no user interaction to execute crafted SQL queries remotely, potentially leading to high confidentiality impact and low availability impact. The CVSS 3.1 base score is 8.5, reflecting the ease of exploitation and significant confidentiality impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to access sensitive data from the database, compromising confidentiality. The vulnerability does not impact data integrity but may cause limited denial of service. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL queries. Avoid exposing the vulnerable plugin to untrusted users or networks.