CVE-2025-12502

The Attention Bar WordPress plugin through version 0.7.2.1 fails to sanitize and escape a parameter before using it in a SQL statement. This lack of input validation allows an attacker to inject arbitrary SQL commands, a classic SQL injection vulnerability [1].

Exploitation requires the attacker to have high privileges, such as administrator or contributor roles, as indicated by the reference [1]. The attack vector is through the vulnerable parameter, which is processed without proper escaping, enabling the injection of malicious SQL queries.

Successful exploitation could allow an attacker to read, modify, or delete sensitive data from the WordPress database, potentially compromising the entire site. The impact is limited to users with high privileges, but the consequences can be severe if an administrator account is compromised.

As of the latest update, no fix is available for this vulnerability [1]. Users are advised to restrict access to high-privilege accounts and monitor for any suspicious activity. The plugin may be discontinued or require manual patching.