The vulnerability identified as CVE-2025-58789 affects the WP Full Stripe Free plugin by Themeisle. It is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This allows an attacker with high privileges to influence SQL queries executed by the plugin, potentially leading to unauthorized disclosure of sensitive data. The vulnerability affects all versions up to 8.2.5. The CVSS 3.1 base score is 7.6, with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact data integrity but may cause limited availability issues. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict plugin access to trusted administrators only and monitor for updates from Themeisle. Avoid exposing the plugin to untrusted users or external inputs that could be manipulated. Apply the official patch promptly once it becomes available.