CVE-2025-22655CWE-89

WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability

Critical · published April 17, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

🚨 An improper neutralization flaw is lurking in Caio Web Dev's Stealth Links, allowing for SQL Injection that could spell disaster! 🔥 Think of it as a restaurant where the chef blindly accepts any order without checking if the ingredients are safe — one malicious order could ruin the entire menu! An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially exposing, altering, or deleting critical data in your database. Imagine a hacker having free rein to whip up a recipe for chaos, where sensitive information is up for grabs!

Put simply

Think of it as a restaurant where the chef blindly accepts any order without checking if the ingredients are safe — one malicious order could ruin the entire menu! This SQL Injection vulnerability in CWD – Stealth Links allows attackers to manipulate SQL queries by injecting malicious code into input fields. Affected versions range from n/a to 1.3, posing a serious risk to data integrity and security.

What to do

An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially exposing, altering, or deleting critical data in your database. Imagine a hacker having free rein to whip up a recipe for chaos, where sensitive information is up for grabs! Immediately patch your installation to version 1.4 or later to eliminate this vulnerability. Additionally, implement parameterized queries to safeguard your database from SQL injection attacks. Don’t forget to conduct a thorough audit of your existing input validation processes! You've got this! With these steps, you'll fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-17T15:17Z
EPSS history
Timeline
  • 17 APR 15:17Z
    WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability
    cvelistv5