This vulnerability (CVE-2026-32471) is an SQL Injection issue classified under CWE-89 affecting the ProLancer Element product by ThemeBing. It impacts versions up to and including 1.4.8. The flaw arises from improper neutralization of special elements used in SQL commands in the Subscriber functionality, enabling an attacker with network access and low privileges to execute crafted SQL commands. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker can exploit this SQL Injection vulnerability remotely with low privileges and no user interaction to compromise the confidentiality of the database and cause a partial denial of service. Integrity is not impacted. The vulnerability affects the Subscriber component of ProLancer Element, potentially exposing sensitive data or disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Users should monitor for vendor updates and apply patches once available.