CVE-2025-30807CWE-89

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerability

Critical · published April 1, 2025

CVSS v3.1
9.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

🔥 An SQL injection vulnerability in Next-Cart Store to WooCommerce Migration could let attackers pull sensitive data with just a single malicious input! Think of it like a restaurant where anyone can change the menu just by whispering the right phrases to the chef — only here, the chef is your database, and the changes can lead to disastrous consequences! An attacker could exploit this vulnerability to gain unauthorized access to your database, allowing them to extract, modify, or even delete crucial data. This could mean compromised customer information or worse — an entirely devastated store operations. It's absolutely devastating!

Put simply

Think of it like a restaurant where anyone can change the menu just by whispering the right phrases to the chef — only here, the chef is your database, and the changes can lead to disastrous consequences! This vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker to inject malicious SQL queries through the migration tool. The affected versions range from n/a to 3.9.4, which makes it all the more pressing to address.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to your database, allowing them to extract, modify, or even delete crucial data. This could mean compromised customer information or worse — an entirely devastated store operations. It's absolutely devastating! To secure your system, update to the latest version immediately. Ensure you implement prepared statements and proper input validation to mitigate the risks of SQL injections. Regularly audit your systems for vulnerabilities to stay ahead! You've got this! By taking these steps, you can lock down your system and keep it safe from potential threats. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00510 · 42.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-01T20:58Z
EPSS history
Timeline
  • 01 APR 20:58Z
    WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerability
    cvelistv5