CVE-2025-5287 is an SQL Injection vulnerability in the erumfaham Likes and Dislikes Plugin for WordPress. The issue arises from improper neutralization of special elements in the 'post' parameter, which is used in SQL queries without sufficient escaping or parameterization. This allows unauthenticated attackers to append malicious SQL commands to existing queries, potentially exposing sensitive data stored in the database. The vulnerability affects all versions up to and including 1.0.0. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation enables unauthenticated attackers to extract sensitive information from the WordPress database by injecting arbitrary SQL commands. This compromises data confidentiality but does not affect integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.