The imithemes Eventer plugin versions prior to 3.11.4 contain an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability. This flaw allows remote attackers to inject SQL commands without authentication, potentially exposing sensitive data (high confidentiality impact) and causing limited denial of service (low availability impact). The vulnerability has been assigned CVE-2025-39481 with a CVSS 3.1 base score of 9.3, reflecting its critical nature. No vendor advisory or patch links are currently available, and the product is not a cloud service.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and may cause limited disruption of service (low availability impact). There is no indication of integrity impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, it is recommended to monitor the vendor's communications for updates and apply any official fixes once available. Until then, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.