The WP Shuffle WP Subscription Forms plugin (versions up to 1.2.3) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This vulnerability allows an attacker with low privileges and no user interaction to execute SQL queries that can compromise confidentiality and availability of the affected system. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial impact on confidentiality and availability without integrity impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive information (confidentiality impact) and limited disruption of service (availability impact). Integrity is not affected. The attacker requires low privileges and no user interaction, increasing the risk. However, no known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality and monitoring for suspicious activity related to SQL queries. Avoid exposing the affected plugin to untrusted users where possible.