The vulnerability CVE-2025-23931 affects the WordPress Local SEO plugin by Oliver Fuhrmann, specifically versions up to and including 2.3. It is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection. This allows remote attackers with no privileges or user interaction to potentially extract sensitive data from the backend database. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a high confidentiality impact but no integrity impact and low availability impact.

Successful exploitation could allow an unauthenticated attacker to extract sensitive information from the database, compromising confidentiality. The integrity of data is not directly impacted, but availability could be slightly affected. This poses a significant risk to sites using the affected plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the vulnerable plugin to mitigate risk.