This vulnerability in weDevs WP ERP (<= 1.16.10) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability could be exploited remotely by an attacker with low privileges to affect the confidentiality of the system and cause limited denial of service.

Successful exploitation could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted. The vulnerability requires low privileges and no user interaction, increasing the risk in environments where the plugin is deployed.

Patch status is not confirmed from the provided information; no official fix or patch links are available. Users should monitor the vendor advisory for updates and apply any official patches once released. Until then, restrict access to the affected plugin and consider additional SQL injection mitigations if possible.