CVE-2025-30528CWE-352

WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability

Critical · published March 24, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

🚨 A dangerously crafted request can lead to SQL injection in Awesome Logos! This vulnerability has a devastating potential. 🔥 Think of it like a restaurant where an unauthorized guest slips in a new ingredient that changes the entire menu — every order coming out could be tainted! 🍽️ An attacker could exploit this CSRF vulnerability to run any SQL command against your database, potentially exposing sensitive data, altering records, or even wiping your database clean. This is the kind of breach that keeps security teams awake at night! 😱

Put simply

Think of it like a restaurant where an unauthorized guest slips in a new ingredient that changes the entire menu — every order coming out could be tainted! 🍽️ This vulnerability allows an attacker to forge requests that execute SQL injection due to improper validation in Awesome Logos version 1.2 and below. It’s like letting a chef add any spice they want without checking their credentials!

What to do

An attacker could exploit this CSRF vulnerability to run any SQL command against your database, potentially exposing sensitive data, altering records, or even wiping your database clean. This is the kind of breach that keeps security teams awake at night! 😱 Immediately update Awesome Logos to the patched version beyond 1.2. Additionally, implement CSRF tokens to ensure that requests are validated as coming from legitimate users. Don’t let this sneaky vulnerability catch you off guard! 🛡️ You've got this! With these steps, you’ll be reinforcing your defenses in no time! 💪

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-24T13:46Z
EPSS history
Timeline
  • 24 MAR 13:46Z
    WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability
    cvelistv5