The vulnerability identified as CVE-2025-32126 affects the cmsMinds Pay with Contact Form 7 plugin (versions up to 1.0.4). It is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. The CVSS 3.1 base score is 7.6, indicating high severity, with an attack vector over the network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or remediation information is currently available.

An attacker with high privileges can exploit this SQL Injection vulnerability to compromise the confidentiality of the affected system's data and cause a limited denial of service. There is no indication of integrity impact. The vulnerability could lead to unauthorized data disclosure or partial service disruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the affected plugin to untrusted users with high privileges. Follow vendor communications for updates on patches or mitigations.