This vulnerability in Agile Logix Store Locator WordPress plugin (<= 1.6.2) is due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. An attacker with low privileges can exploit this remotely without user interaction, potentially causing a complete confidentiality breach of the backend database and limited denial of service. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No official patch or remediation information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely by an attacker with low privileges without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin functionality to trusted users only and monitor for unusual database queries. Avoid exposing the vulnerable plugin to untrusted networks. Follow vendor updates closely for an official fix.