This vulnerability in King-Theme Lumise Product Designer (versions before 2.0.9) involves improper neutralization of special elements used in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 score of 9.3 indicates that the vulnerability can be exploited remotely without privileges or user interaction, resulting in high confidentiality impact and low availability impact. The issue allows attackers to extract sensitive data from the backend database by manipulating SQL queries. No vendor advisory or patch links are currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an unauthenticated remote attacker to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no indication of integrity impact. The vulnerability affects all versions of Lumise Product Designer prior to 2.0.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable application to untrusted networks where possible.