The vulnerability identified as CVE-2025-30569 affects the Jahertor WP Featured Entries WordPress plugin up to version 1.0. It is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 base score is 8.5, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction. The impact scope is changed, with high confidentiality impact and low availability impact, but no integrity impact. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

An attacker with low privileges can exploit this vulnerability remotely to execute arbitrary SQL commands on the affected database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The integrity of the data is not affected according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Featured Entries plugin if possible, or restrict access to trusted users only. Monitor for updates from the vendor or security advisories for a patch or official mitigation.