The vulnerability CVE-2025-30775 affects WPGuppy plugin versions up to 1.1.3. It is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 base score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (confidentiality impact) and causing partial denial of service (availability impact). Integrity is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin and applying any available workarounds if provided by the vendor.