The ichurakov Paid Downloads plugin suffers from an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability. This allows unauthenticated remote attackers to inject SQL queries, potentially compromising the confidentiality of the database. The vulnerability affects all versions up to 3.15. The CVSS v3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow attackers to extract sensitive information from the backend database due to Blind SQL Injection. The confidentiality impact is high, as attackers may retrieve data without authorization. Integrity is not impacted, and availability impact is low. The vulnerability is exploitable remotely without authentication, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying temporary mitigations such as input validation, web application firewalls, or disabling the plugin if feasible. Monitor vendor channels for updates and patches.