This vulnerability involves improper neutralization of special elements in SQL commands within the All In One SEO Pack plugin, enabling blind SQL injection attacks. It affects all versions through 4.9.1. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation details are provided in the available data.

Successful exploitation could allow an attacker with low privileges to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable plugin functionality and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users with low privileges where possible.