CVE-2025-46248CWE-89

WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability

Critical · published April 24, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
30.1
In the wild
Unconfirmed
What it is

🔥 A crafty SQL injection vulnerability lurks in versions of the Frontend Dashboard up to 2.2.5, allowing attackers to manipulate your database with ease! Think of it as a restaurant where a diner can slip a secret ingredient into every meal, altering the entire menu without any oversight — that’s how this SQL injection can compromise your data. An attacker could execute commands that read, modify, or even delete data in your database, leading to a catastrophic data breach. This could spell disaster for your organization, as sensitive information could be lost or stolen in the blink of an eye.

Put simply

Think of it as a restaurant where a diner can slip a secret ingredient into every meal, altering the entire menu without any oversight — that’s how this SQL injection can compromise your data. This vulnerability stems from improper handling of special elements within SQL commands, allowing for SQL injection attacks that can exploit the Frontend Dashboard's database layer.

What to do

An attacker could execute commands that read, modify, or even delete data in your database, leading to a catastrophic data breach. This could spell disaster for your organization, as sensitive information could be lost or stolen in the blink of an eye. To protect yourself, immediately upgrade to version 2.2.6 or later. Ensure you are using prepared statements in your SQL queries to avoid injection risks, and conduct a thorough audit of your database interactions. You've got this! With these steps, you'll be back on track, keeping your data safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-24T16:08Z
EPSS history
Timeline
  • 24 APR 16:08Z
    WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability
    cvelistv5