This vulnerability, identified as CWE-89, involves improper neutralization of special elements used in SQL commands within the WP Activity Log plugin by Melapress. It affects versions up to 5.6.6 and allows an administrator to perform SQL Injection attacks. The CVSS 3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor vendor communications for updates. Until a fix is available, restricting administrator access and auditing SQL queries may help reduce risk.