This vulnerability involves improper neutralization of special elements used in SQL commands within the Kofi Mokome Message Filter for Contact Form 7 plugin (versions <= 1.6.3.2). It allows an attacker with high privileges to perform SQL Injection, potentially leading to partial denial of service and high confidentiality impact. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to partial denial of service and disclosure of sensitive information due to SQL Injection. The attacker must have high privileges to exploit this vulnerability, and no integrity impact is indicated. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to the plugin. Avoid exposing the vulnerable plugin to untrusted users.