This vulnerability in VeronaLabs WP SMS plugin (versions <= 6.9.12) is due to improper neutralization of special elements used in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6, indicating a high severity issue with network attack vector, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is primarily on confidentiality (high) and availability (low), with no integrity impact reported. No patch or official remediation guidance is currently available.

An attacker with high privileges could exploit this SQL Injection vulnerability to access or disclose sensitive data from the database, potentially leading to confidentiality breaches. The vulnerability does not impact data integrity but may cause limited availability issues. Since exploitation requires high privileges, the risk is mitigated somewhat by the need for elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the WP SMS plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted users with elevated privileges.