The ketanajani Duplicate Title Checker plugin versions up to 1.2 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw enables blind SQL injection attacks, allowing an attacker with network access and low privileges to extract sensitive data from the database without direct interaction. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with network attack vector, low attack complexity, and no required user interaction. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported. No patch or official remediation guidance is currently documented.

Successful exploitation could allow an attacker to perform blind SQL injection, potentially exposing sensitive database information (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (low availability impact). No known exploits are reported, and the attack requires low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the affected plugin and monitoring for unusual database queries. Avoid using affected versions of the Duplicate Title Checker plugin if possible.