The miniOrange Custom API for WP plugin versions up to 4.2.2 suffer from an SQL Injection vulnerability (CVE-2025-54048) caused by improper neutralization of special elements in SQL commands. This allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially compromising the confidentiality of the database. The vulnerability has a CVSS 3.1 base score of 9.3, reflecting its critical severity and ease of exploitation. No vendor advisory or patch links have been provided, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data due to SQL Injection. The CVSS vector indicates no privileges or user interaction are required, making remote exploitation feasible. The impact on confidentiality is high, while integrity is not affected, and availability impact is low. There are currently no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to the API endpoints to trusted users only. Monitor vendor communications for updates and apply patches promptly once available.