CVE-2024-12025 is an SQL Injection vulnerability in the Collapsing Categories plugin for WordPress, affecting all versions up to 3.0.8. The issue arises from insufficient escaping of the 'taxonomy' parameter in the /wp-json/collapsing-categories/v1/get REST API endpoint, combined with a lack of prepared statements in the SQL query construction. This allows unauthenticated attackers to append malicious SQL queries to extract sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or remediation details are currently available from the vendor or public advisories.

Successful exploitation enables unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable REST API endpoint or removing the Collapsing Categories plugin if feasible. Monitoring vendor channels for updates is recommended.