The vulnerability identified as CVE-2025-30998 affects the WP Links Page plugin by Rico Macchi. It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The affected versions include all versions up to 4.9.6. The CVSS 3.1 score is 8.5, reflecting a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix has been documented, and the vulnerability is not related to a cloud service.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin functionality to trusted users only and applying web application firewall rules to detect and block SQL injection attempts targeting this plugin.