CVE-2025-39484CWE-89sql-injection

CVE-2025-39484

Critical · published January 5, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

🔥 A sneaky SQL injection vulnerability is lurking in Waituk Entrada, enabling attackers to manipulate your database like a puppet master pulling strings! Think of it like a restaurant where the chef decides to serve whatever the waiter writes on the order slip, without checking if the ingredients are safe or legitimate—yikes! An attacker could exploit this vulnerability to run malicious SQL commands, potentially accessing, altering, or even deleting your data. This could lead to absolute chaos, compromising sensitive information and damaging business integrity. Now that’s a recipe for disaster!

Put simply

Think of it like a restaurant where the chef decides to serve whatever the waiter writes on the order slip, without checking if the ingredients are safe or legitimate—yikes! The flaw in Waituk Entrada allows attackers to inject SQL commands through improperly neutralized input. This means they could execute queries that the application shouldn’t normally allow, giving them unauthorized access to critical data.

What to do

An attacker could exploit this vulnerability to run malicious SQL commands, potentially accessing, altering, or even deleting your data. This could lead to absolute chaos, compromising sensitive information and damaging business integrity. Now that’s a recipe for disaster! Immediately patch to version 5.7.8 or higher to close this dangerous gap. Implement prepared statements and parameterized queries to safeguard against future injections. Regularly review and sanitize all user inputs as well! You've got this! Follow these steps and you'll be safeguarding your data in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-05T22:15Z
References (1)
EPSS history
Timeline
  • 05 JAN 16:53Z
    WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability
    cvelistv5