The vulnerability CVE-2025-68496 in Syed Balkhi User Feedback plugin (userfeedback-lite) versions up to 1.10.0 is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection. This allows an attacker with high privileges to remotely exploit the vulnerability over the network without user interaction, potentially compromising confidentiality of data. The CVSS score is 7.6 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact.

Successful exploitation of this vulnerability could allow an attacker with high privileges to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity of data is not impacted, and availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — no patch or official fix information is provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, restrict high privilege access to the affected plugin and consider disabling or removing the plugin if feasible to reduce risk.