CVE-2025-13370 is a time-based SQL Injection vulnerability in the ProjectList plugin for WordPress, affecting all versions up to 0.3.0. The issue arises from improper neutralization of special elements in the 'id' parameter, allowing authenticated users with Editor-level access or higher to append malicious SQL commands to existing queries. This vulnerability stems from insufficient escaping of user input and lack of prepared statements, enabling attackers to extract sensitive data from the database without impacting availability. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation permits authenticated users with Editor or higher privileges to perform time-based SQL Injection attacks, potentially exposing sensitive database information. The vulnerability does not affect system integrity or availability but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and monitor for unusual database activity related to the ProjectList plugin. Avoid using the affected versions of the plugin if possible.