The vulnerability CVE-2025-68550 affects the VillaTheme WPBulky plugin for WordPress, allowing improper neutralization of special elements in SQL commands. This results in a Blind SQL Injection vulnerability where an attacker with high privileges can manipulate SQL queries, potentially exposing sensitive data. The affected versions include all releases up to 1.1.13. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database due to Blind SQL Injection. The attacker must have high privileges on the system, which limits the attack surface. The vulnerability does not impact data integrity but may cause limited availability issues. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the WPBulky plugin and monitor for unusual database activity related to SQL injection attempts.