CVE-2025-3436 is an SQL Injection vulnerability in the coreActivity: Activity Logging for WordPress plugin affecting all versions up to 2.7. The vulnerability arises from improper neutralization of special elements in SQL commands via the 'order' and 'orderby' parameters. Authenticated attackers with at least Subscriber privileges can append malicious SQL code to existing queries, enabling unauthorized data extraction. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and limited privileges required. No patch or official vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation allows authenticated users with Subscriber-level access or higher to extract sensitive information from the WordPress database by injecting SQL commands. The vulnerability does not impact data integrity or availability but compromises confidentiality. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the plugin. Avoid using the affected plugin versions if possible.