CVE-2025-31928: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-31928) has been identified in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support plugin versions through 2.6.0. The vulnerability was discovered by Tran Nguyen Bao Khanh from VCI - VNPT Cyber Immunity and was publicly disclosed on May 16, 2025 (Wiz).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) with a CVSS v3.1 base score of 8.5 HIGH. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is changed (S:C) with high impact on confidentiality (C:H), no impact on integrity (I:N), and low impact on availability (A:L) (Wiz, Patchstack).

The SQL injection vulnerability could allow a malicious actor to directly interact with the database, potentially leading to unauthorized access to sensitive information. The vulnerability has been assessed with a high confidentiality impact, indicating significant potential for data exposure (Wiz).

The vulnerability requires low privileges (contributor level access) to exploit. No public exploit has been reported at the time of disclosure (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 2.6.0, and no patched version has been released at the time of disclosure (Wiz).