The vulnerability CVE-2025-22507 affects the iDo8p WPMU Prefill Post plugin (versions up to 1.02) and is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows an attacker with high privileges to execute unauthorized SQL queries, potentially impacting confidentiality and causing limited availability disruption. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information and limited disruption of service availability. Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restricting access to high-privilege accounts and limiting exposure of the affected plugin may reduce risk.