This vulnerability in Cozmoslabs Paid Member Subscriptions (up to version 2.15.1) involves improper neutralization of special elements used in SQL commands, leading to SQL Injection. The issue allows an unauthenticated attacker to potentially affect the confidentiality of the database by injecting malicious SQL code. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker to access sensitive information from the database, compromising confidentiality. There is no indication of integrity compromise, but availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.