CVE-2025-32550: 
WordPress vulnerability analysis and mitigation

The CVE-2025-32550 is a SQL Injection vulnerability discovered in the ClickandPledge Click & Pledge Connect Plugin for WordPress. The vulnerability was disclosed on April 9, 2025, affecting versions from 2.24080000 through WP6.6.1 of the plugin (Patchstack, NVD).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. The vulnerability is tracked under CWE-89 and does not require authentication to exploit (Patchstack).

This SQL Injection vulnerability could allow malicious actors to directly interact with the database, potentially leading to unauthorized data access and manipulation. The CVSS score indicates a high severity impact, though Patchstack has categorized it as having a low severity impact and is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.24120000-WP6.7.1 of the Click & Pledge Connect Plugin. Users are advised to update to this version or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).