This vulnerability involves improper neutralization of special elements in SQL commands within the Syed Balkhi User Feedback plugin, enabling blind SQL injection. It affects versions up to 1.10.1 and requires high privileges to exploit. The CVSS score is 7.6, indicating a high severity with network attack vector, low attack complexity, no user interaction, and a scope change. Confidentiality impact is high, integrity impact is none, and availability impact is low. No patch or official remediation level has been provided by the vendor or advisory sources.

An attacker with high privileges can exploit this vulnerability to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity of data is not impacted, but availability impact is low, possibly causing minor disruption. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the affected plugin to trusted users with high privileges and monitor for unusual database activity related to User Feedback plugin usage.