CVE-2025-8977 is a time-based SQL Injection vulnerability in the Simple Download Monitor plugin for WordPress, affecting all versions up to 3.9.33. The issue arises from insufficient escaping and lack of proper preparation of the 'order' parameter in SQL queries. Authenticated attackers with Contributor-level access and permissions from an Administrator can append malicious SQL queries to extract sensitive data from the database. The vulnerability is network exploitable with low attack complexity and does not require user interaction. The CVSS 3.1 base score is 6.5, reflecting high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an authenticated user with Contributor-level access and appropriate permissions to extract sensitive information from the database via SQL Injection. This compromises the confidentiality of the data stored by the plugin but does not affect data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and review permissions granted by Administrators to limit potential exploitation. Avoid using the vulnerable versions of the plugin if possible.