This vulnerability in Cozmoslabs Paid Member Subscriptions (<= 2.15.1) involves improper neutralization of special elements in SQL commands, leading to SQL Injection. The flaw allows remote attackers to execute crafted SQL commands without authentication or user interaction, potentially compromising database confidentiality and causing limited availability impact. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official fix information is available at this time.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL Injection attacks, potentially exposing sensitive database information (high confidentiality impact) and causing limited disruption to service availability (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.