The vulnerability CVE-2025-23784 affects the Contact Form 7 Round Robin Lead Distribution plugin by David Jeffrey. It is an SQL Injection flaw caused by improper sanitization of input used in SQL commands. This allows an attacker to inject malicious SQL code, potentially compromising the underlying database. The affected versions include all releases up to 1.2.1. No patch or official fix information is currently available, and no known exploits have been reported. The plugin is self-hosted, so remediation requires applying vendor patches when available or implementing other protective measures.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to manipulate database queries, which may lead to unauthorized data access, data modification, or other database-related impacts depending on the environment and privileges. However, there are no known exploits in the wild at this time, and the exact impact depends on the deployment context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the vendor and consider applying temporary mitigations such as input validation or disabling the plugin if feasible. No official fix or patch links are currently available.