CVE-2025-48141CWE-89

WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability

Critical · published June 9, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

🚨 An unguarded SQL command is the entire exploit! This vulnerability in Multi CryptoCurrency Payments lets an attacker slip dangerous SQL code right into your database. 🔥 Think of it like a restaurant that accepts orders without checking the ticket — if a customer can just scribble their own dish, they might end up with a feast at someone else's expense! An attacker could gain complete control over your database, allowing them to read sensitive data, modify records, or even delete everything. This could lead to devastating consequences for your business and your clients' trust!

Put simply

Think of it like a restaurant that accepts orders without checking the ticket — if a customer can just scribble their own dish, they might end up with a feast at someone else's expense! This SQL injection vulnerability allows attackers to inject malicious SQL statements into queries that the application executes, potentially compromising the entire database. It affects Multi CryptoCurrency Payments versions up to 2.0.7.

What to do

An attacker could gain complete control over your database, allowing them to read sensitive data, modify records, or even delete everything. This could lead to devastating consequences for your business and your clients' trust! Immediately patch to version 2.0.8 or later. Implement prepared statements to safeguard against SQL injections, and ensure that user inputs are thoroughly validated. Don't wait — secure your application now! You've got this! Follow these steps, and you'll be the hero who keeps the data safe! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-06-09T15:53Z
EPSS history
Timeline
  • 09 JUN 15:53Z
    WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability
    cvelistv5