CVE-2025-6348 is a time-based SQL Injection vulnerability in the Smart Slider 3 WordPress plugin affecting all versions up to 3.5.1.28. The issue arises from improper neutralization of special elements in the 'sliderid' parameter, allowing authenticated administrators to append malicious SQL queries. This vulnerability is categorized under CWE-89 and has a CVSS 3.1 base score of 4.9 (medium severity) with network attack vector, low attack complexity, and high privileges required. The vulnerability impacts confidentiality by enabling data extraction but does not affect integrity or availability. No patch or official fix has been documented in the provided data.

An attacker with Administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability affects confidentiality but does not impact data integrity or availability. Since exploitation requires high privileges and no known exploits are reported, the immediate risk is moderate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the Smart Slider 3 plugin. Avoid using vulnerable versions of the plugin where possible.