CVE-2025-31044CWE-89sql-injection

CVE-2025-31044

High · published January 5, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL injection vulnerability hides in the AA-Team Premium SEO Pack, allowing attackers to slip malicious commands right under the radar! 🔍 Think of it like a restaurant where a diner can sneak their own ingredients into a dish without the chef noticing. Just one clever suggestion can change the entire recipe, leading to an unappetizing outcome! If exploited, bad actors could manipulate your database, potentially allowing them to steal sensitive data, alter content, or even delete critical information. It’s like giving someone the keys to your pantry, leaving everything vulnerable to tampering and theft!

Put simply

Think of it like a restaurant where a diner can sneak their own ingredients into a dish without the chef noticing. Just one clever suggestion can change the entire recipe, leading to an unappetizing outcome! This vulnerability occurs due to improper neutralization of special elements used in SQL commands, allowing attackers to execute their own SQL queries within the application. This can happen in Premium SEO Pack versions from n/a through 3.3.2.

What to do

If exploited, bad actors could manipulate your database, potentially allowing them to steal sensitive data, alter content, or even delete critical information. It’s like giving someone the keys to your pantry, leaving everything vulnerable to tampering and theft! Immediate action is required: update to the latest version of the Premium SEO Pack to patch this vulnerability. Additionally, review and sanitize all SQL inputs to ensure no malicious commands can slip through! You’ve got this! With these steps, you can secure your application and keep those SQL injections at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-05T16:17Z
References (1)
EPSS history
Timeline
  • 05 JAN 10:23Z
    WordPress Premium SEO Pack <= 3.3.2 - SQL Injection Vulnerability
    cvelistv5