The vulnerability identified as CVE-2025-46539 affects WPFable Fable Extra versions up to 1.0.6. It is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The CVSS 3.1 score is 9.3 (critical), with attack vector network, low attack complexity, no privileges or user interaction required, and scope changed. The impact includes high confidentiality loss and low availability impact. No vendor advisory or patch links are available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to conduct Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply any available workarounds or input validation controls to mitigate SQL Injection risks. Monitor vendor communications for updates on patches or official mitigations.