CVE-2025-58604 describes an SQL Injection vulnerability in the WPFunnels Mail Mint product, affecting versions up to 1.18.5. The vulnerability is due to improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to execute arbitrary SQL queries. The CVSS 3.1 base score is 7.6 (High), with attack vector network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low), but not integrity. No vendor advisory or patch information is currently provided.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or disclose sensitive information from the database (high confidentiality impact) and cause partial denial of service (low availability impact). Integrity is not impacted. The vulnerability requires network access and high privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the Mail Mint application and monitor for suspicious activity. Avoid exposing the vulnerable versions to untrusted networks. Follow vendor updates closely for patches or official mitigations.