The vulnerability CVE-2025-32120 in edanzer Easy Query – WP Query Builder arises from improper neutralization of special elements in SQL commands, enabling blind SQL injection. This affects versions up to 2.0.4. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is available from the vendor or advisory.

Successful exploitation could allow an attacker with high privileges to extract sensitive information from the database through blind SQL injection, compromising confidentiality. Integrity is not impacted, and availability impact is low. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users.