CVE-2025-48091CWE-89sql-injection

CVE-2025-48091

High · published October 22, 2025

CVSS v3.1
8.5
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL injection vulnerability in AnyComment could let attackers sneak in commands through your input forms! 🚨 Think of it like a restaurant that accepts any order without checking the ingredients — a bad recipe could lead to a disastrous dish for everyone! With this vulnerability, an attacker could manipulate your database, potentially stealing sensitive information or altering crucial data. Imagine a situation where they could change menu prices or even wipe entire tables clean — absolutely devastating!

Put simply

Think of it like a restaurant that accepts any order without checking the ingredients — a bad recipe could lead to a disastrous dish for everyone! This vulnerability allows attackers to inject SQL commands into AnyComment's input fields, bypassing normal authentication checks and executing arbitrary queries against the database.

What to do

With this vulnerability, an attacker could manipulate your database, potentially stealing sensitive information or altering crucial data. Imagine a situation where they could change menu prices or even wipe entire tables clean — absolutely devastating! Upgrade to AnyComment version 0.3.7 immediately to patch this vulnerability. Additionally, validate and sanitize all user input to prevent injection attacks from occurring in the future. Regularly audit your code for similar vulnerabilities! You've got this! Follow these steps and you'll fortify your application against SQL injections like a pro! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerability
    cvelistv5