The gopiplus iFrame Images Gallery plugin for WordPress contains an SQL Injection vulnerability identified as CVE-2025-30969. This issue arises from improper neutralization of special elements used in SQL commands, allowing an attacker with low privileges to execute unauthorized SQL queries. The vulnerability affects all versions up to 9.0. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation of this vulnerability could allow an attacker to access sensitive information from the database (high confidentiality impact) and cause limited denial of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's functionality to trusted users only and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting this plugin.