CVE-2025-1321 is an SQL Injection vulnerability in the teachPress WordPress plugin affecting all versions up to 9.0.7. The flaw exists in the 'order' parameter of the 'tpsearch' shortcode, where user input is not properly escaped or parameterized, allowing authenticated users with Contributor-level permissions or higher to append malicious SQL commands. This can be exploited to extract sensitive data from the underlying database. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with Contributor-level or higher access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling the 'tpsearch' shortcode if feasible. Monitor for updates from the plugin vendor and apply patches promptly once available.