This vulnerability, identified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), exists in the WP Sessions Time Monitoring Full Automatic plugin version 1.1.4 and earlier. It allows an attacker with low privileges to perform SQL injection via the Subscriber functionality. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, no user interaction required, and scope change. The impact includes high confidentiality loss and low availability impact. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SQL injection vulnerability to access or manipulate sensitive database information, resulting in a high confidentiality impact. The vulnerability also causes a low impact on availability. There is no indication of integrity impact. The vulnerability can be exploited remotely without user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor the vendor's communications for updates. Until a patch is released, consider restricting access to the vulnerable plugin functionality or disabling the plugin if feasible.