CVE-2025-0861 is an SQL Injection vulnerability in the VR-Frases plugin for WordPress, affecting all versions up to 3.0.1. The issue arises from insufficient escaping and lack of prepared statements on user-supplied input parameters, enabling attackers to inject additional SQL commands. This vulnerability can be exploited without user interaction but requires high privileges. It can lead to unauthorized disclosure of sensitive database information. No known exploits are reported in the wild, and no patch or official fix is currently available.

An attacker with high privileges can exploit this vulnerability to extract sensitive information from the database by injecting malicious SQL queries. The vulnerability does not impact integrity or availability but compromises confidentiality. Since the attacker must have high privileges, the risk is somewhat limited but still significant due to the potential data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin and its parameters to trusted users only. Applying Web Application Firewall (WAF) rules to detect and block SQL injection attempts may provide temporary mitigation.