The CMS Commander WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements in the restore workflow. Specifically, the parameters 'or_blogname', 'or_blogdescription', and 'or_admin_email' can be manipulated by authenticated users possessing an API key to inject additional SQL commands. This allows attackers to extract sensitive data from the backend database. The vulnerability affects all versions up to and including 2.288. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated attacker with API key access to execute arbitrary SQL queries appended to legitimate queries, leading to potential disclosure of sensitive information, modification, or deletion of data, and disruption of database availability. This compromises confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API key access to trusted users only and monitor for unusual activity related to the vulnerable parameters. Avoid exposing the CMS Commander API to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.