CVE-2025-47608CWE-89

WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

Critical · published June 9, 2025

CVSS v3.1
9.3
EPSS
1%
Percentile
65.7
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection lurks in the Recover abandoned cart for WooCommerce! This vulnerability could let an attacker wield SQL commands like a magician with a wand. 🔥 Think of it like a restaurant accepting any order without checking the menu — one rogue customer could request something outrageous that ends up affecting everyone else! It's like serving up a side of chaos along with every meal. If exploited, an attacker could access or manipulate your database, potentially leading to complete data compromise. Imagine every customer's order being wrong or sensitive info being leaked — it's an absolute disaster waiting to happen!

Put simply

Think of it like a restaurant accepting any order without checking the menu — one rogue customer could request something outrageous that ends up affecting everyone else! It's like serving up a side of chaos along with every meal. This SQL injection vulnerability allows attackers to insert malicious SQL statements through user inputs, making it possible to gain unauthorized access to the database. It affects Recover abandoned cart for WooCommerce versions n/a through 2.5.

What to do

If exploited, an attacker could access or manipulate your database, potentially leading to complete data compromise. Imagine every customer's order being wrong or sensitive info being leaked — it's an absolute disaster waiting to happen! Immediately update to the latest version of the Recover abandoned cart for WooCommerce plugin. Additionally, sanitize and validate all user inputs to prevent SQL injection. Don’t wait—secure your site now! You've got this! Fixing this vulnerability will put you in the hero's seat, protecting your users and your data! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01113 · 65.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-06-09T15:54Z
EPSS history
Timeline
  • 09 JUN 15:54Z
    WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability
    cvelistv5