The kamleshyadav Miraculous Core Plugin contains an improper neutralization of special elements used in an SQL command, resulting in a blind SQL Injection vulnerability. This affects all versions before 2.1.2. The vulnerability allows remote attackers with low privileges to inject SQL commands without requiring user interaction, potentially compromising data confidentiality and causing limited availability issues. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and may cause limited disruption to service availability. Integrity impact is not indicated. There are no known exploits in the wild currently.

No official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisories for updates and apply any official fixes once released. Until then, restricting access to the plugin and minimizing privileges may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.