CVE-2025-2128 is a time-based SQL Injection vulnerability in the WordPress Cost Calculator Builder plugin by stylemix. It affects all versions up to and including 3.2.67. The vulnerability is due to improper neutralization of special elements in the 'order_ids' parameter, allowing authenticated users with at least Subscriber privileges to inject additional SQL queries. This is caused by insufficient escaping of user input and lack of prepared statements in the affected SQL queries. Exploitation can lead to unauthorized disclosure of sensitive database information. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and partial confidentiality impact without integrity or availability impact.

An attacker with Subscriber-level or higher access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact data integrity or availability according to the CVSS vector. There are no known exploits in the wild currently, but the risk remains due to the ability to extract confidential data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user privileges where possible and monitor for suspicious activity related to the 'order_ids' parameter. Avoid exposing this plugin on publicly accessible sites or consider disabling it if not essential.