CVE-2025-4204 is an SQL Injection vulnerability in the Ultimate Auction Pro plugin for WordPress, affecting all versions up to 1.5.2. The issue arises from insufficient escaping of the 'auction_id' parameter and lack of prepared statements in SQL queries. This allows unauthenticated attackers to append additional SQL commands, potentially extracting sensitive data from the backend database. The vulnerability is remotely exploitable without privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, and no required privileges.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect data integrity or availability according to the CVSS vector. Because the attack requires no authentication, it poses a significant risk to affected installations. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable parameters via web application firewall rules or other filtering mechanisms. Monitor vendor channels for updates and apply patches promptly once available.