This vulnerability in WP Photo Album Plus arises from improper neutralization of special elements used in SQL commands, classified as CWE-89. It enables blind SQL injection attacks, potentially allowing an attacker to extract sensitive information from the database without direct visibility of the output. The affected versions include all versions up to 9.1.13.005. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database due to blind SQL injection. The confidentiality impact is high, but integrity impact is not affected, and availability impact is low. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the vulnerable plugin or disabling it if possible. Monitor official sources for updates from the vendor regarding fixes.