The vulnerability identified as CVE-2025-24659 involves improper neutralization of special elements in SQL commands within the Shahjada WPDM – Premium Packages plugin, leading to Blind SQL Injection. This allows an attacker with high privileges to perform unauthorized SQL queries that can disclose sensitive information (confidentiality impact) and cause limited denial of service (availability impact). The vulnerability affects versions up to 5.9.6. No vendor advisory or patch information is currently available.

An attacker with high privileges can exploit this vulnerability to perform Blind SQL Injection attacks, potentially exposing sensitive data from the database (high confidentiality impact) and causing limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. There is no evidence of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to trusted users only and monitor for unusual database activity related to the plugin. Avoid exposing the affected plugin to untrusted users. Follow vendor channels for updates on patches or official mitigations.