This vulnerability (CVE-2025-22351) in the Contact Form 7 Database – CFDB7 plugin arises from improper neutralization of special elements in SQL commands, leading to SQL Injection. It affects versions up to 1.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact. No official patch or vendor advisory is currently available, and no exploits are known in the wild. The plugin is not cloud-hosted, so remediation depends on patching by the vendor or mitigation by the user.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should restrict access to the plugin to trusted administrators only and monitor for unusual database activity. No official fixes or temporary mitigations have been published at this time.