This vulnerability (CVE-2026-66630) is an improper neutralization of special elements used in an SQL command (CWE-89) in PublishPress Series versions up to 3.1.3. It enables an attacker with administrator privileges to perform SQL Injection attacks, potentially leading to unauthorized data disclosure and partial denial of service. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is available at this time.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data and partial denial of service. The integrity impact is not indicated, but confidentiality is rated high and availability low. Exploitation requires high privileges, limiting the attack surface to trusted users with admin access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to SQL commands in the application.