CVE-2025-0821 describes a time-based SQL Injection vulnerability in the Bit Assist WordPress plugin 'Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat' affecting all versions up to 1.5.2. The issue arises from improper neutralization of special elements in the 'id' parameter, allowing authenticated users with Subscriber-level privileges or higher to append malicious SQL queries to existing database queries. This vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 6.5 with network attack vector, low attack complexity, and requiring privileges but no user interaction. The impact is primarily on confidentiality, enabling extraction of sensitive database information without affecting integrity or availability.

The vulnerability allows an authenticated attacker with Subscriber-level access or higher to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The confidentiality of data is at risk, but there is no direct impact on data integrity or availability according to the CVSS vector. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict Subscriber-level access where possible and consider additional input validation or web application firewall rules to mitigate SQL injection risks.