This vulnerability in don-themes Riode Core arises from improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. Affected versions include all releases up to and including 1.6.26. The CVSS 3.1 score of 9.3 reflects a critical severity with network attack vector, no required privileges or user interaction, and a significant confidentiality impact. No vendor advisory or patch links have been provided, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to extract sensitive information from the backend database via Blind SQL Injection. The confidentiality of data is highly impacted, while integrity is not affected and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring vendor channels for updates is advised.