An SQL injection vulnerability in Shahjada’s Download Manager Addons for Elementor allows malicious users to inject unsanitized input into database queries. The flaw permits blind SQL injection, meaning that an attacker could, through timing or error messages, infer the presence of tables, retrieve sensitive data or glean database structure. This could compromise confidentiality and integrity of the site’s data. The described impact is inferred from the nature of blind injection and is not explicitly detailed in the CVE description.

The vulnerability exists in the WordPress plugin Download Manager Addons for Elementor, version 1.3.0 and earlier, distributed by Shahjada. No specific patch level is listed for earlier releases.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is below 1 %, suggesting a very low current exploitation probability, and the flaw is not listed in CISA’s KEV catalog. The flaw can be exploited remotely through the plugin’s HTTP interface; the exact attack vector is inferred from typical WordPress plugin weaknesses and is not detailed in the description.