This vulnerability (CVE-2026-74011) in revmakx InfiniteWP Client is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands. It enables Blind SQL Injection, which can allow an attacker with high privileges to extract sensitive information from the database without direct visibility of the data. The affected versions include all versions up to 1.13.9. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database due to Blind SQL Injection. The vulnerability does not impact data integrity but can cause partial denial of service. The attack requires high privileges and no user interaction, limiting the attack surface somewhat but still posing a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor vendor communications for updates and consider limiting access privileges to reduce risk.