A blind SQL injection flaw permits unauthenticated attackers to construct and execute arbitrary SQL statements against the database. Because the injection is blind, attackers can infer database structure and data by timing or error differences, potentially exfiltrating sensitive information or corrupting data. This weakness is a classic example of CWE‑89 and can have serious consequences for confidentiality and integrity of site data.

The flaw is present in the Jefferson49 Sexy Polling Reloaded extension for Joomla, affecting all installations running a version earlier than 5.6.1. Joomla sites leveraging this plugin without an updated component are therefore exposed.

The CVSS score of 8.7 indicates high impact and overall potential. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of an authentication requirement and blind SQL injection typically facilitate automated attacks. The vulnerability is not listed in CISA’s KEV catalog, but its high severity warrants prompt attention. Based on the description, the attack vector is likely through web parameters exposed by the extension, where an attacker can submit crafted input without any pre‑existing credentials.