The vulnerability CVE-2025-39510 affects the ValvePress Pinterest Automatic Pin WordPress plugin before version 4.19.0. It is caused by improper neutralization of special elements in SQL commands, leading to an SQL Injection flaw. This allows an attacker with network access and low privileges to execute crafted SQL commands without user interaction. The vulnerability impacts confidentiality and availability but not integrity, as per the CVSS vector. No known exploits in the wild have been reported. Patch or remediation status is not confirmed due to lack of vendor advisory or patch information.

Successful exploitation of this vulnerability could allow an attacker to read sensitive information from the database and cause a partial denial of service. The CVSS vector indicates high confidentiality impact and low availability impact, with no integrity impact. The attacker requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official ValvePress communications for updates. Until a fix is available, consider restricting access to the plugin's functionality and applying web application firewall (WAF) rules to detect and block SQL injection attempts specific to this plugin.