The Salesmate Add-On for Gravity Forms version 2.0.3 and earlier suffers from an SQL Injection vulnerability (CVE-2025-31551) caused by improper neutralization of special elements in SQL commands. This flaw allows remote attackers to execute arbitrary SQL queries without authentication, potentially exposing sensitive data. The CVSS v3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable add-on or disabling it if feasible to reduce exposure.