This vulnerability in CleverReach® WP (versions <= 1.5.20) allows remote attackers to perform SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates that the attack can be performed remotely without privileges or user interaction, can affect system confidentiality significantly, and causes low availability impact. The vulnerability is publicly disclosed but no patch or fix details are available from the vendor or advisory sources.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to disclosure of sensitive data (high confidentiality impact). Integrity is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.