The Detheme Easy Guide WordPress plugin (versions up to 1.0.0) contains an SQL Injection vulnerability (CVE-2025-46460) caused by improper neutralization of special elements in SQL commands. This flaw allows remote attackers to execute arbitrary SQL code without authentication or user interaction, potentially compromising the confidentiality of the database and causing limited denial of service. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not affect data integrity. The attack can be performed remotely without authentication or user interaction, increasing its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.