CVE-2026-54809 is a critical SQL Injection vulnerability in VillaTheme GIFT4U that allows improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. This vulnerability affects versions up to and including 1.0.10. The CVSS 3.1 score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker can remotely exploit this vulnerability without authentication or user interaction to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. This could compromise the confidentiality of the database contents used by the GIFT4U product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or limiting exposure of the affected application to untrusted networks. Monitor vendor channels for updates.