CVE-2025-14770 is an SQL Injection vulnerability in the Shipping Rate By Cities plugin for WordPress, affecting all versions up to 2.0.0. The issue arises from insufficient escaping and lack of prepared statements on the 'city' parameter, enabling unauthenticated attackers to append malicious SQL queries. This can lead to unauthorized data disclosure from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can result in unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. Since no privileges or user interaction are required, the attack surface is broad. There are no known exploits in the wild currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is recommended.