The vulnerability CVE-2025-31920 in AmentoTech WP Guppy (<= 4.3.3) is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This allows an attacker with network access and low privileges to execute crafted SQL queries without user interaction, potentially exposing sensitive data and causing limited denial of service. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and partial confidentiality and availability impacts. No vendor patch or advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive information (confidentiality impact: high) and limited disruption of service (availability impact: low). Integrity is not affected. The attacker requires low privileges and no user interaction, increasing the risk. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected WP Guppy plugin versions or applying any available workarounds from the vendor. Monitor for vendor updates regarding patches or mitigations.