This vulnerability involves improper neutralization of special elements in SQL commands within the shinetheme Traveler product, enabling Blind SQL Injection attacks. It affects all versions before 3.2.8. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact is high on confidentiality, no impact on integrity, and low impact on availability. No patch or official remediation guidance is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database via Blind SQL Injection, compromising confidentiality. Integrity is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access privileges and monitoring for unusual database activity related to SQL injection attempts. Avoid exposing vulnerable versions to untrusted networks.