The vulnerability CVE-2025-23912 exists in the WordPress Custom Sidebar plugin (versions <= 2.3) due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. This allows an attacker with low privileges to remotely exploit the plugin without user interaction, potentially exposing sensitive data (high confidentiality impact) and causing limited denial of service (low availability impact). The CVSS 3.1 base score is 8.5, reflecting the high severity of this issue. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to disclosure of sensitive information from the database (high confidentiality impact) and may cause limited denial of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges and no user interaction, making it easier to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying any available temporary mitigations from the vendor. Monitor official Philipp Speck or WordPress plugin sources for updates.