The vulnerability CVE-2025-28939 affects the EuroCizia WP Google Calendar Manager plugin for WordPress, specifically versions up to and including 2.1. It is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database due to blind SQL injection, compromising confidentiality. The integrity of data is not impacted, and availability impact is low. The vulnerability affects the confidentiality of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin functionality to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted networks or users.