This vulnerability involves improper neutralization of special elements in SQL commands within King-Theme Lumise Product Designer, enabling Blind SQL Injection attacks. The affected versions are all releases before 2.0.9. The CVSS score of 9.3 indicates a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact includes high confidentiality loss and low availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could allow an attacker to extract sensitive data from the database (confidentiality impact is high) and cause partial denial of service (availability impact is low). Integrity impact is not indicated. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable application to untrusted networks.