CVE-2025-52823 is an SQL Injection vulnerability in the ovatheme Cube Portfolio plugin (versions ≤ 1.16.8). It results from improper neutralization of special elements in SQL commands, enabling an attacker with low privileges to execute crafted SQL queries. The CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory information is currently available.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute unauthorized SQL commands, potentially leading to high confidentiality impact (data disclosure) and limited availability impact (partial denial of service). Integrity is not impacted according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.