CVE-2025-10175 is an SQL Injection vulnerability in the WP Links Page plugin for WordPress, affecting all versions up to 4.9.6. The issue stems from improper neutralization of special elements in the 'id' parameter, allowing authenticated users with at least Subscriber privileges to inject additional SQL commands. This is due to insufficient escaping and lack of prepared statements in the plugin's SQL query handling. The vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS 3.1 score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to execute unauthorized SQL queries, potentially extracting sensitive information from the database. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider restricting Subscriber-level access where possible and applying additional web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'id' parameter in the WP Links Page plugin.