This vulnerability (CVE-2025-32550) in the ClickandPledge Click & Pledge Connect Plugin is classified as CWE-89, indicating improper neutralization of special elements in SQL commands, commonly known as SQL Injection. It affects versions from 2.24080000 through WP6.6.1. The CVSS 3.1 base score is 7.2 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact includes potential integrity and availability loss, but no confidentiality impact is indicated. No patch or official fix has been documented, and no known exploits have been reported.

Successful exploitation could allow an attacker to alter SQL queries executed by the plugin, potentially leading to data integrity issues or denial of service. Confidentiality impact is not indicated. The vulnerability could be exploited remotely without authentication or user interaction, increasing risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's interfaces and monitor for unusual activity. Avoid exposing the plugin to untrusted networks. Follow vendor channels for updates on patches or mitigations.