This vulnerability involves improper neutralization of special elements in SQL commands within WP Inventory Manager, enabling blind SQL injection attacks. The affected versions include all releases up to and including 2.4.0. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is available, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin and monitoring for suspicious activity related to SQL injection attempts.