CVE-2025-7670 is a time-based SQL Injection vulnerability in the skatox JS Archive List WordPress plugin (up to version 6.1.5). The issue exists in the build_sql_where() function due to insufficient escaping of user-supplied parameters and lack of proper query preparation. This allows unauthenticated attackers to inject additional SQL queries into existing database commands, potentially exposing sensitive information. The vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the WordPress database. The vulnerability does not impact integrity or availability but compromises confidentiality. Since the attacker can execute time-based SQL injection, they can infer data from the database even if direct output is not returned.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the JS Archive List plugin or restricting access to it as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.