This vulnerability (CVE-2026-65526) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It affects the Themeisle Visualizer plugin, allowing blind SQL injection attacks. The affected versions are from the initial release up to version 4.0.7 (exclusive). The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. There is no vendor advisory or patch information available at this time.

An attacker with low privileges can exploit this vulnerability remotely over the network without user interaction to perform blind SQL injection. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted users. Follow vendor communications for updates on patches or mitigations.