This vulnerability in CleverReach® WP (<= 1.5.21) allows remote attackers to perform SQL Injection due to improper sanitization of special elements in SQL commands. The flaw enables execution of unauthorized SQL queries without requiring privileges or user interaction, potentially leading to disclosure of sensitive data. The vulnerability is rated critical with a CVSS 3.1 base score of 9.3, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected database, leading to unauthorized disclosure of sensitive information. The vulnerability does not impact data integrity but may cause limited availability disruption. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the CleverReach® WP plugin if possible or restrict access to the affected functionality to trusted users only.