The WP Text Expander plugin for WordPress, developed by Andrei Filonov, contains an SQL Injection vulnerability (CVE-2025-49421) due to improper neutralization of special elements in SQL commands. This vulnerability affects all versions up to 1.0.1. The CVSS 3.1 base score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No patch or official remediation information is currently available.

An attacker with high privileges on the system can exploit this SQL Injection vulnerability to access or disclose sensitive data, leading to a high confidentiality impact. The vulnerability also causes a low impact on availability, potentially disrupting service. There is no impact on data integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to the WP Text Expander plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users. Follow vendor communications for updates on patches or mitigations.