This vulnerability (CVE-2026-66580) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the RexTheme Product Feed Manager. It affects versions up to 7.12.0 and allows an attacker with low privileges to execute crafted SQL commands that can lead to partial confidentiality compromise and limited denial of service. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, no user interaction, and scope change with high confidentiality impact but no integrity impact and low availability impact.

An attacker can exploit this SQL Injection vulnerability remotely with low complexity and no user interaction, potentially leading to partial disclosure of sensitive data and limited disruption of service. The integrity of data is not impacted according to the CVSS vector. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict access to the affected application and monitor for unusual activity related to SQL injection attempts.