This vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member (versions <= 1.1.3) involves improper neutralization of special elements used in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6 (high), with network attack vector, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact, but no integrity impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with high privileges can exploit this SQL Injection vulnerability to access sensitive data (high confidentiality impact) and cause a partial denial of service (low availability impact). There is no reported impact on data integrity. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict high-privilege access to the affected plugin and consider disabling it if feasible until a fix is available.