CVE-2025-24667CWE-89

WordPress Small Package Quotes Plugin <= 5.2.17 - SQL Injection vulnerability

Critical · published January 27, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

🔥 Brace yourselves! The enituretechnology Small Package Quotes – Worldwide Express Edition is vulnerable to SQL injection, affecting versions up to and including 5.2.17! Think of it like a restaurant that takes orders without checking the menu. A crafty attacker could substitute their own dish, getting into the kitchen and manipulating the entire menu! This SQL injection vulnerability can lead to absolutely devastating outcomes, allowing attackers to access, modify, or even delete sensitive data. With the power to manipulate the database, they're not just dining in the restaurant; they're running the whole kitchen. Imagine the chaos!

Put simply

Think of it like a restaurant that takes orders without checking the menu. A crafty attacker could substitute their own dish, getting into the kitchen and manipulating the entire menu! This vulnerability arises from improper neutralization of special elements in SQL commands, allowing attackers to craft malicious SQL queries that can bypass normal application controls and directly interact with the database.

What to do

This SQL injection vulnerability can lead to absolutely devastating outcomes, allowing attackers to access, modify, or even delete sensitive data. With the power to manipulate the database, they're not just dining in the restaurant; they're running the whole kitchen. Imagine the chaos! To secure your system, immediately patch to version 5.2.18 or later. Additionally, review your SQL queries for proper parameterization and implement prepared statements to prevent these types of injections. Don't wait! You've got this! With these steps, you'll safeguard your application and earn your Security Hero badge! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-01-27T14:22Z
EPSS history
Timeline
  • 27 JAN 14:22Z
    WordPress Small Package Quotes Plugin <= 5.2.17 - SQL Injection vulnerability
    cvelistv5