This vulnerability in WP Roadmap (<= 2.1.3) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability allows an attacker to execute crafted SQL commands potentially leading to unauthorized data disclosure and partial service disruption.

Successful exploitation could lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted. The attack requires low privileges and no user interaction, increasing the risk in environments where the plugin is installed and accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor vendor communications for updates and consider restricting access to the affected plugin until a fix is available.