The Wp tabber widget (versions <= 4.0) contains an SQL Injection vulnerability caused by improper neutralization of special elements used in SQL commands. This flaw allows an attacker with low privileges and no user interaction to execute unauthorized SQL commands, potentially leading to partial data confidentiality loss and limited denial of service. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute SQL commands on the backend database. This can result in partial disclosure of sensitive data and limited denial of service conditions. Integrity is not impacted according to the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable widget and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the widget to untrusted users where possible.