The kamleshyadav WP Lead Capturing Pages plugin (version 2.5 and earlier) contains an improper neutralization of special elements used in SQL commands, resulting in a blind SQL injection vulnerability. This allows an attacker with network access and low privileges to inject SQL commands, potentially leading to partial data confidentiality loss and limited denial of service. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality and availability.

Successful exploitation could allow an attacker to extract information from the database via blind SQL injection, impacting confidentiality. The vulnerability does not affect integrity but can cause limited denial of service, affecting availability. The attack requires low privileges and no user interaction, increasing the risk. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing the plugin to untrusted networks. Follow vendor updates closely for any official fixes.