The roninwp Revy plugin versions up to 2.1 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with network access and low privileges to execute crafted SQL queries without user interaction, potentially exposing sensitive data (confidentiality impact) and causing limited disruption to service availability. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and partial confidentiality impact.

Successful exploitation could allow an attacker to extract sensitive information from the database, impacting confidentiality. The integrity of the data is not affected, and availability impact is low. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits have been reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected plugin and monitor for suspicious activity related to SQL queries. Avoid exposing the vulnerable plugin to untrusted networks. Follow vendor channels for updates on patches or official mitigations.