The vulnerability CVE-2025-47490 in Rustaurius Ultimate WP Mail plugin allows SQL Injection due to improper neutralization of special elements in SQL commands. It affects versions up to 1.3.4. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No official patch or remediation details are provided in the available data.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive information and partial denial of service. The integrity of data is not directly impacted according to the CVSS vector. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the plugin to untrusted users. Follow vendor communications closely for updates on patches or official mitigations.