This vulnerability (CVE-2025-28983) in ClickandPledge Click & Pledge Connect is due to improper neutralization of special elements in SQL commands (CWE-89), commonly known as SQL Injection. It affects versions from 25.04010101 through WP6.8 and allows attackers to escalate privileges by injecting malicious SQL code. The CVSS 3.1 base score is 9.8, reflecting critical impact with full confidentiality, integrity, and availability compromise possible via network without authentication or user interaction. The vendor has not published a patch or advisory detailing remediation steps. The product is not a cloud service, so remediation depends on vendor patching or user updates.

Successful exploitation of this SQL Injection vulnerability can lead to privilege escalation, allowing attackers to gain unauthorized access and control over the affected system. The impact includes complete compromise of confidentiality, integrity, and availability of the application and potentially underlying data stores. Given the CVSS score of 9.8, this represents a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the affected application and applying any available workarounds recommended by the vendor once published.