CVE-2025-30936CWE-89

WordPress Torod plugin <= 2.1 - SQL Injection vulnerability

Critical · published July 16, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability in Torod allows attackers to disrupt your data with the tiniest of manipulations! 🔥 Think of it like a restaurant that accepts any order without checking the menu. If a patron yells out a wrong order, the kitchen might serve up something utterly inappropriate, leading to a chaotic dinner service! An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially reading, modifying, or even deleting critical data from your database! This could lead to devastating breaches of sensitive information and a complete operational meltdown.

Put simply

Think of it like a restaurant that accepts any order without checking the menu. If a patron yells out a wrong order, the kitchen might serve up something utterly inappropriate, leading to a chaotic dinner service! This SQL injection vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious users to craft inputs that manipulate database queries.

What to do

An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially reading, modifying, or even deleting critical data from your database! This could lead to devastating breaches of sensitive information and a complete operational meltdown. Immediately patch your Torod installation to version 2.1 or later to protect against this vulnerability. Consider implementing prepared statements and input validation to harden your application against future attacks. You’ve got this! Follow these steps and you'll be on your way to securing your system in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00435 · 36.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-07-16T11:28Z
EPSS history
Timeline
  • 16 JUL 11:28Z
    WordPress Torod plugin <= 2.1 - SQL Injection vulnerability
    cvelistv5