The wpdistillery Navigation Tree Elementor plugin suffers from an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability. This affects versions up to 1.0.1 and allows an attacker with low privileges to perform SQL injection attacks remotely without user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or remediation information is currently available.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database (high confidentiality impact) and cause limited disruption to availability (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid granting unnecessary privileges to users interacting with the plugin.