The vulnerability CVE-2025-49854 in Anh Tran Slim SEO (versions <= 4.5.4) is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. This allows an attacker with high privileges to execute unauthorized SQL queries, potentially compromising sensitive data confidentiality and causing limited availability impact. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available.

An attacker with high privileges can exploit this SQL Injection vulnerability to access sensitive data, leading to a high confidentiality impact. The vulnerability does not affect data integrity but may cause a low impact on availability. No known exploits exist in the wild, so active exploitation has not been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the Slim SEO plugin and monitor for unusual database activity related to SQL commands. Avoid exposing the plugin to untrusted users with elevated privileges.