CVE-2025-30523 describes an SQL Injection vulnerability in Marcel-NL's Super Simple Subscriptions plugin versions up to 1.1.0. The issue is caused by improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to affect the confidentiality and availability of the system. The CVSS 3.1 base score is 7.6, with network attack vector, low attack complexity, required privileges, no user interaction, and a scope change. No patch or mitigation details are provided in the available data.

The vulnerability allows an attacker with high privileges to perform SQL Injection, potentially leading to unauthorized disclosure of sensitive information (confidentiality impact) and partial denial of service (availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any official patches once available. Until then, restricting access to trusted users with high privileges may reduce risk.