CVE-2025-11501 identifies an SQL Injection vulnerability in the Dynamically Display Posts plugin for WordPress, specifically affecting all versions up to and including 1.1. The issue arises from improper neutralization of special elements in the 'tax_query' parameter, allowing unauthenticated attackers to append malicious SQL queries. This occurs because user input is not sufficiently escaped and the SQL query is not properly prepared, enabling extraction of sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official remediation has been published at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the WordPress database. Since the attack vector requires no privileges and no user interaction, the risk is elevated. However, there are no reports of active exploitation in the wild. The vulnerability does not impact integrity or availability based on the CVSS vector, but confidentiality is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Dynamically Display Posts plugin if it is not essential. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.