CVE-2026-32471: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ThemeBing ProLancer Element

This vulnerability (CVE-2026-32471) is an SQL Injection issue classified under CWE-89 in ThemeBing's ProLancer Element product. It affects all versions up to and including 1.4.8. The vulnerability arises from improper neutralization of special elements used in SQL commands within the Subscriber functionality, allowing an attacker with network access and low privileges to inject SQL commands. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

An attacker can exploit this SQL Injection vulnerability remotely with low privileges and no user interaction. The impact includes a high confidentiality breach and a low availability impact, potentially exposing sensitive subscriber data and causing partial service disruption. There are no known exploits in the wild at this time.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, cautious handling of the affected component and limiting exposure may be advisable.