The kamleshyadav WP Lead Capturing Pages plugin versions before 2.6 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw enables unauthenticated remote attackers to conduct Blind SQL Injection attacks, potentially compromising sensitive data confidentiality and causing partial denial of service. The vulnerability is publicly known and assigned CVE-2025-31424 with a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to high confidentiality impact by allowing attackers to extract sensitive information from the database via Blind SQL Injection. Integrity is not directly impacted, but availability may be slightly affected (low impact). The vulnerability is remotely exploitable without authentication, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the affected plugin to prevent exploitation.