The HK WP Online Users Stats plugin versions up to 1.0.0 suffer from a blind SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This allows remote attackers to inject SQL code without authentication, potentially exposing sensitive data. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. No patch or official fix information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and may cause partial denial of service (low availability impact). Integrity impact is not indicated. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the affected plugin if feasible. Monitor official HK vendor channels for updates and apply patches promptly once released.