CVE-2025-32685: 
WordPress vulnerability analysis and mitigation

Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability has been identified in Aristo Rinjuang WP Inquiries plugin, affecting versions through 0.2.1. The vulnerability was discovered by Phan Trong Quan from VNPT Cyber Immunity and was publicly disclosed on April 9, 2025 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.6 (High severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. The issue is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (Patchstack).

This SQL Injection vulnerability could allow a malicious actor to directly interact with the database, potentially leading to unauthorized access to sensitive information. The vulnerability requires administrator privileges to exploit (Patchstack).

As there is no official fix available and the software is considered abandoned, it is strongly recommended to remove and replace the WP Inquiries plugin with an alternative solution. Deactivating the software alone does not remove the security threat (Patchstack).