CVE-2025-5017 is a time-based SQL Injection vulnerability in the Catalyst Connect Zoho CRM Client Portal WordPress plugin affecting versions up to 2.2.0. The flaw exists due to improper neutralization of special elements in the 'uid' parameter, allowing authenticated administrators to inject additional SQL queries. This vulnerability can be exploited to extract sensitive information from the backend database. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity) with network attack vector, low attack complexity, and requires high privileges without user interaction. No official fix or patch has been disclosed by the vendor as of the published date.

An authenticated attacker with Administrator-level privileges can exploit this vulnerability to perform time-based SQL Injection attacks. This may lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the 'uid' parameter. Avoid using vulnerable versions (<=2.2.0) in production environments if possible.