CVE-2025-4203 is an SQL Injection vulnerability in the wpForo Forum WordPress plugin, specifically in the get_members() function. The vulnerability stems from improper input validation on the 'offset' and 'row_count' parameters, which are used directly in a SQL LIMIT clause without enforcing numeric constraints. The esc_sql() function is used but does not prevent exploitation because MySQL 5.x allows a PROCEDURE ANALYSE clause after LIMIT, which attackers can exploit to perform error-based or time-based blind SQL injection. This allows unauthenticated attackers to extract sensitive information from the database. The vulnerability affects all versions up to and including 2.4.8. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to perform error-based or time-based blind SQL injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable get_members() functionality or applying custom input validation to enforce numeric constraints on 'offset' and 'row_count' parameters. Monitor vendor channels for updates or patches addressing this vulnerability.