CVE-2025-22699CWE-89

WordPress Traveler Code plugin < 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerability

Critical · published February 4, 2025

CVSS v3.1
9.0
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

🚨 A crafty SQL injection vulnerability in Traveler Code could let attackers manipulate your database with ease, making your data security a total breeze for them! 🔥 Think of this as a sneaky chef who can add any ingredient to your secret sauce recipe without you even knowing—every dish they create could ruin your restaurant's reputation! An attacker could exploit this vulnerability to gain unauthorized access to sensitive data like customer info, modify entries, or even delete critical records. The potential damage? Absolutely devastating, as it could lead to data breaches and loss of user trust, not to mention hefty fines!

Put simply

Think of this as a sneaky chef who can add any ingredient to your secret sauce recipe without you even knowing—every dish they create could ruin your restaurant's reputation! This SQL injection vulnerability allows attackers to insert malicious SQL commands into a query, compromising the integrity of your database and potentially granting them full control over its operations.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to sensitive data like customer info, modify entries, or even delete critical records. The potential damage? Absolutely devastating, as it could lead to data breaches and loss of user trust, not to mention hefty fines! To protect your application, update Traveler Code to version 3.1.2 or later immediately to close this loophole. Additionally, make sure to implement parameterized queries and input validation in your code to further strengthen your defenses. You've got this! Follow these steps to tighten security and keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-02-04T14:21Z
EPSS history
Timeline
  • 04 FEB 14:21Z
    WordPress Traveler Code plugin < 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerability
    cvelistv5