The CubeWP Framework WordPress plugin versions prior to 1.1.31 contain a SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of a parameter used in a SQL query within an AJAX action. The vulnerability is further exacerbated by the absence of a capability check on the AJAX action, enabling users with minimal privileges (Subscriber-level and above) to perform SQL injection attacks. This could allow attackers to manipulate database queries, potentially leading to unauthorized data access or modification.

Attackers with Subscriber-level access or higher can exploit this vulnerability to perform SQL injection attacks, which may result in unauthorized access to or modification of the database. The exact impact depends on the database structure and the queries affected but generally includes data leakage, data corruption, or privilege escalation within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and monitor for suspicious activity related to AJAX actions in the plugin. Avoid granting Subscriber-level or higher access to untrusted users.