This vulnerability involves improper neutralization of special elements in SQL commands within the LambertGroup Video Player & FullScreen Video Background plugin, allowing blind SQL injection attacks. It affects all versions up to and including 2.4.1. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch links are currently available, and the product is not a cloud service.

An attacker with high privileges can exploit this blind SQL injection vulnerability to extract sensitive data from the backend database, impacting confidentiality. The integrity is not affected, and availability impact is low. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the affected plugin and monitor for suspicious activity related to SQL injection attempts.