This vulnerability (CVE-2026-93527) is an SQL Injection flaw in bdthemes Live Copy Paste for Elementor plugin versions up to and including 1.5.10. It arises from improper neutralization of special elements used in SQL commands (CWE-89). The flaw allows an attacker with low privileges and no user interaction to execute SQL commands that can compromise confidentiality and cause limited availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No official patch or vendor advisory is provided in the input data, and no known exploits in the wild are reported.

An attacker with low privileges can exploit this SQL Injection vulnerability to access sensitive data (high confidentiality impact) without requiring user interaction. The vulnerability has limited impact on availability (low) and no impact on data integrity. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor bdthemes advisories for updates. Until a fix is available, restrict plugin access to trusted users and consider disabling the plugin if possible to reduce risk.