CVE-2025-39586: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability has been identified in Metagauss ProfileGrid affecting versions through 5.9.4.8. The vulnerability was discovered and reported by Trương Hữu Phúc, and was assigned CVE-2025-39586. This security flaw affects authenticated users with Subscriber or higher privileges (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It has received a CVSS v3.1 base score of 8.5 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. The vulnerability allows authenticated users with Subscriber or higher privileges to perform SQL injection attacks (NVD).

The SQL injection vulnerability could allow malicious actors to directly interact with the database, potentially leading to unauthorized access to sensitive information. Given the high CVSS score of 8.5, this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

Users are advised to update to ProfileGrid version 5.9.4.9 or later, which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).