This vulnerability in WPMart Team Member (up to version 8.5) involves improper neutralization of special elements in SQL commands, categorized as CWE-89. It enables Blind SQL Injection attacks, where an attacker with high privileges can manipulate SQL queries to extract sensitive information without direct visibility of query results. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No official patch or remediation level has been published by the vendor or authoritative sources.

An attacker with high privileges can exploit this vulnerability remotely to perform Blind SQL Injection, potentially exposing sensitive data (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to SQL queries. Avoid granting unnecessary high privileges to users of the Team Member plugin.