This vulnerability involves improper neutralization of special elements used in SQL commands within the LambertGroup Image&Video FullScreen Background plugin (lbg_fullscreen_fullwidth_slider). Versions up to and including 1.6.7 are affected. The flaw allows an attacker with low privileges to perform SQL Injection attacks remotely without user interaction. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker to access sensitive data (high confidentiality impact) and cause limited denial of service (low availability impact). Integrity is not impacted. The vulnerability requires low privileges but no user interaction, and the attack can be performed remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Monitor vendor communications for updates and apply any official fixes once available.