The vulnerability CVE-2025-52717 in LifterLMS (up to version 8.0.6) is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows remote attackers with no privileges and no user interaction to execute crafted SQL queries that can compromise confidentiality and partially affect availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. The vulnerability is publicly disclosed but lacks vendor advisory or patch information.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected LifterLMS database, potentially leading to disclosure of sensitive information (confidentiality impact is high) and limited disruption of service (availability impact is low). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected LifterLMS installation and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.