The CleverReach® WP plugin for WordPress suffers from a time-based SQL Injection vulnerability via the 'title' parameter in versions up to 1.5.20. Due to improper neutralization of special elements in SQL commands (CWE-89), unauthenticated attackers can append malicious SQL queries to existing ones, potentially extracting sensitive data from the database. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without affecting integrity or availability. No patch or official remediation has been provided in the available data.

Successful exploitation allows unauthenticated attackers to perform time-based SQL Injection attacks, enabling them to extract sensitive information from the plugin's database. The vulnerability impacts confidentiality but does not affect data integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to the vulnerable parameter to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.