This vulnerability involves improper neutralization of special elements in SQL commands within the Lead Form Data Collection to CRM plugin by Smackcoders Inc. Specifically, it allows blind SQL injection attacks, enabling an attacker with network access and low privileges to potentially extract sensitive data from the backend database. The affected versions include all releases up to and including 3.0.1. The CVSS v3.1 base score is 8.5, reflecting high impact on confidentiality and low impact on availability, with no required user interaction.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database due to blind SQL injection. The integrity of data is not impacted, and availability impact is low. There are no reports of active exploitation in the wild. The vulnerability requires network access and low privileges, which may limit the attack surface to authenticated or semi-trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin functionality and monitor for unusual database queries. Avoid exposing the vulnerable plugin to untrusted networks. Follow up with Smackcoders Inc. for updates on patches or official mitigations.