CVE-2025-28972 describes an SQL Injection vulnerability in the WP Employee Attendance System plugin for WordPress, specifically versions up to 3.5. The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with high privileges to perform Blind SQL Injection attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is provided in the available data.

Successful exploitation could allow an attacker with high privileges to extract sensitive information from the database via Blind SQL Injection, potentially compromising confidentiality. Integrity is not impacted, and availability impact is low. No known exploits in the wild have been reported, which may reduce immediate risk but does not eliminate it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and monitor for suspicious activity. Avoid granting unnecessary high privileges to users of the WP Employee Attendance System plugin.