This vulnerability in the Eli EZ SQL Reports Shortcode Widget and DB Backup plugin allows an attacker to exploit a CSRF weakness to perform SQL Injection attacks. The affected versions are up to and including 5.25.08. The CVSS vector indicates the attack can be performed remotely with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality with high severity and causes low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected system, potentially leading to disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires user interaction but no privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.