The WP AutoKeyword plugin for WordPress, developed by EXEIdeas International, contains an SQL Injection vulnerability identified as CVE-2025-31579. This vulnerability arises from improper neutralization of special elements in SQL commands, allowing remote attackers to execute arbitrary SQL queries. The affected versions include all versions up to 1.0. The CVSS v3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is high confidentiality loss and low availability impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). There is no indication of integrity impact. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the WP AutoKeyword plugin to mitigate risk. Monitor official EXEIdeas International channels for updates or patches addressing this vulnerability.