This vulnerability in WP Chill Download Monitor plugin (<= 5.1.8) is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection. An attacker with network access and low privileges can exploit this to extract sensitive data from the database without user interaction. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact, low attack complexity, and no user interaction required. The vulnerability affects the plugin when installed on vulnerable WordPress sites.

Exploitation could lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). Integrity is not impacted, and availability impact is low. The attacker requires low privileges but no user interaction is needed. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from WP Chill regarding a security patch.