This vulnerability involves improper neutralization of special elements in SQL commands within the Media LIbrary Assistant plugin by David Lingren. It allows blind SQL injection attacks, which can be exploited remotely with low attack complexity and no user interaction required. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact, no integrity impact, and low availability impact. The vulnerability affects all versions up to 3.32. No patch or official remediation guidance is currently provided.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database (high confidentiality impact) without altering data integrity. The availability impact is low, meaning the service may experience minor disruptions but not complete denial of service. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and limit privileges of users who can interact with it. Monitor for updates from the vendor and apply official fixes once released.