This vulnerability (CVE-2025-31640) affects the Magic Responsive Slider and Carousel WordPress plugin by LambertGroup. It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The affected versions are all versions before 1.6. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No vendor patch or advisory is currently provided, and no known exploits are reported in the wild.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The vulnerability can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). There is no reported integrity impact. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor for updates from LambertGroup and apply any official patches once available. Until then, consider restricting access to the plugin or disabling it if possible to reduce exposure.