The vulnerability CVE-2025-30806 affects the Vimeotheque plugin by Constantin Boiangiu, specifically versions up to 2.3.4.2. It is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. The CVSS 3.1 base score is 8.5 (high), with network attack vector, low attack complexity, requiring low privileges, no user interaction, and scope changed. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits in the wild or patch information is currently available.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to service availability (low availability impact). There is no reported impact on data integrity. The scope of the vulnerability is changed, indicating that the attack can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.