This vulnerability in onOffice for WP-Websites allows SQL Injection due to improper neutralization of special elements in SQL commands. It affects all versions up to 5.7. The CVSS vector indicates network attack vector, low attack complexity, requires high privileges, no user interaction, scope changed, with high confidentiality impact and low availability impact. No official patch or vendor advisory is provided in the available data.

An attacker with high privileges could exploit this SQL Injection vulnerability to compromise database confidentiality and potentially affect availability. The integrity impact is not indicated as affected. There are no known exploits in the wild, and the vulnerability affects on-premises installations of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected plugin and monitor for suspicious activity related to SQL queries. Avoid exposing the plugin to untrusted users with elevated privileges.