CVE-2025-0723 is an SQL Injection vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The flaw arises from improper neutralization of special elements in SQL commands (CWE-89) due to insufficient escaping and lack of prepared statements for user-supplied rid and search parameters. Authenticated attackers with Subscriber-level privileges can exploit this to append SQL queries, enabling extraction of sensitive data from the database. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows authenticated users with Subscriber-level access or higher to perform blind and time-based SQL injection attacks, potentially exposing sensitive database information. The vulnerability does not impact system integrity or availability directly but compromises confidentiality of data stored in the database.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting Subscriber-level access where possible and applying strict input validation or web application firewall rules targeting the vulnerable parameters may help reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.