CVE-2025-48278 describes an SQL Injection vulnerability in the RSVPMarker plugin developed by davidfcarr. The issue is due to improper neutralization of special elements used in SQL commands, which can be exploited remotely over the network by an attacker with low privileges and without requiring user interaction. The vulnerability can lead to a partial denial of service and impacts confidentiality but does not affect integrity. It affects RSVPMarker versions up to 11.5.6. There is no vendor advisory or patch information provided, and no known exploits have been reported.

The vulnerability allows an attacker to perform SQL Injection attacks remotely with low privileges and no user interaction. The impact includes partial denial of service and confidentiality loss. Integrity is not impacted. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor davidfcarr regarding RSVPMarker. Until a fix is available, consider restricting access to the affected plugin or applying compensating controls if feasible.