CVE-2025-11980 is an SQL Injection vulnerability in the Quick Featured Images WordPress plugin caused by improper neutralization of special elements in SQL commands within the 'delete_orphaned' function. The vulnerability arises from insufficient escaping of user-supplied parameters and lack of prepared statements, enabling authenticated users with Editor privileges or higher to append malicious SQL queries. Exploitation depends on social engineering to have an author-level or higher user add a crafted custom field value. The CVSS 3.1 score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive database information due to SQL Injection. The vulnerability does not impact data integrity or availability directly, but confidentiality is compromised. Attackers must have Editor-level or higher privileges and rely on social engineering to trigger the injection via a malicious custom field value. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level and higher privileges to trusted users only and monitor for suspicious custom field modifications. Avoid adding untrusted custom field values. Follow vendor updates closely for any released patches or official mitigations.