This vulnerability involves improper neutralization of special elements used in SQL commands within the Contact Us page of the Contact people LITE plugin (versions up to 3.7.4). It is classified as an SQL Injection issue, allowing an attacker with low privileges to execute crafted SQL commands. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact includes high confidentiality compromise and low availability impact, but no integrity impact is noted. No known exploits are reported in the wild, and no patch or vendor advisory is currently provided.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The impact includes potential unauthorized access to confidential data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity of data is not affected according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable Contact Us page and monitoring for unusual database activity related to this plugin. Avoid using affected versions (up to 3.7.4) in production environments if possible.