The CubeWP Framework WordPress plugin versions prior to 1.1.31 contain a SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of a parameter used in a SQL query within an AJAX action. This AJAX action also does not enforce capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to perform SQL injection attacks. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. The vulnerability impacts confidentiality and integrity but does not affect availability. Given the low privilege required and high impact on data confidentiality and integrity, this poses a significant risk to affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit access to the vulnerable AJAX action. Monitor for updates from the CubeWP Framework maintainers and apply patches promptly once released.