CVE-2025-12646 is an SQL Injection vulnerability in the Community Events WordPress plugin by jackdewey. The issue arises from improper neutralization of special elements in the 'dayofyear' parameter, allowing attackers to append arbitrary SQL commands to existing queries. This occurs because user input is not sufficiently escaped and the SQL queries are not properly prepared. The vulnerability affects all versions up to 1.5.4 and can be exploited without authentication, potentially exposing sensitive database information. The CVSS 3.1 base score is 7.5, indicating high severity. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database. Since the attack vector is network-based and requires no privileges or user interaction, it poses a significant risk to affected WordPress sites using the vulnerable plugin versions. There is no indication of impact on data integrity or availability based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Community Events plugin if it is not essential. Monitoring for updates from the vendor or security advisories is recommended to apply any forthcoming patches promptly.