CVE-2025-14353 is an SQL Injection vulnerability in the presstigers ZIP Code Based Content Protection plugin for WordPress, affecting all versions up to and including 1.0.2. The issue stems from insufficient escaping and lack of proper preparation of the 'zipcode' parameter in SQL queries, enabling unauthenticated attackers to inject additional SQL commands. This can be exploited to extract sensitive information from the backend database. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks via the 'zipcode' parameter, potentially leading to unauthorized disclosure of sensitive information stored in the database. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from presstigers. Until a fix is available, consider disabling the plugin or restricting access to the vulnerable functionality to trusted users only.