This vulnerability involves improper neutralization of special elements in SQL commands within the Media LIbrary Assistant plugin by David Lingren. It allows blind SQL injection attacks, which can be exploited remotely with low attack complexity and no user interaction required. The CVSS score of 8.5 reflects a high severity with network attack vector, low attack complexity, privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The affected versions include all versions up to 3.32.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database (high confidentiality impact) and cause limited disruption to service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known public exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access privileges to the plugin and monitor for suspicious activity related to SQL queries. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for any forthcoming patches.