The vulnerability identified as CVE-2025-24663 affects the Simple Download Monitor plugin by mra13. It is caused by improper neutralization of special elements in SQL commands, leading to a Blind SQL Injection issue. This allows an attacker with high privileges to inject SQL commands remotely over the network without user interaction, potentially compromising data confidentiality and causing partial denial of service. The affected versions include all releases up to 3.9.25. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation of this Blind SQL Injection vulnerability can lead to unauthorized disclosure of sensitive information (confidentiality impact is high) and partial disruption of service (availability impact is low). Integrity impact is not indicated. The attack requires high privileges and network access, but no user interaction is needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and limit user privileges to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.