This vulnerability in themesuite Automotive Listings (versions up to 18.6) is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The flaw allows remote attackers to execute unauthorized SQL queries without authentication or user interaction, potentially leading to disclosure of sensitive data and partial denial of service. The CVSS 3.1 score of 9.3 reflects critical impact on confidentiality and some impact on availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (confidentiality impact) and partial denial of service (availability impact). Integrity is not impacted according to the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level input validation and web application firewalls to detect and block SQL injection attempts. Monitor vendor channels for updates and patches.