This vulnerability, identified as CWE-89, is an SQL Injection flaw in the Subscriber component of MVPThemes Reviewer plugin versions up to 3.14.2. It allows remote attackers with low privileges to inject malicious SQL commands due to improper sanitization of input, leading to high confidentiality impact and limited availability impact. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation could allow an attacker to access or disclose sensitive database information (high confidentiality impact) without integrity modification, and cause a limited denial of service (low availability impact). The vulnerability requires low privileges and no user interaction, making it relatively easy to exploit remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable component and applying web application firewall rules to detect and block SQL injection attempts targeting this plugin.