The vulnerability CVE-2025-52714 in shinetheme Traveler (versions before 3.2.2) is an SQL Injection issue caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, low attack complexity, no privileges or user interaction needed, and a scope change affecting confidentiality with limited availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow attackers to execute arbitrary SQL commands remotely, leading to unauthorized disclosure of sensitive data. The vulnerability impacts confidentiality significantly but does not affect integrity and only slightly affects availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring vendor channels for updates is advised.