CVE-2025-59557CWE-89sql-injection

CVE-2025-59557

Critical · published October 22, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

🚨 A single poorly sanitized input could unleash a SQL command flood! This SQL Injection vulnerability in ThemeMove Learts Addons is a critical concern for your data security! 🔥 Think of it like a restaurant where the chef takes orders without checking the menu, leading to unexpected ingredients being added to every dish. An attacker can slip in malicious SQL commands just as easily, reshaping your database instead of the perfect meal! This vulnerability could lead to an attacker executing any SQL command they please, allowing them to read sensitive data, manipulate your database, or even wipe it clean. The potential damage is absolutely devastating! Your entire system's integrity hangs in the balance if this is left unchecked.

Put simply

Think of it like a restaurant where the chef takes orders without checking the menu, leading to unexpected ingredients being added to every dish. An attacker can slip in malicious SQL commands just as easily, reshaping your database instead of the perfect meal! This SQL injection vulnerability in Learts Addons occurs due to improper neutralization of special elements in SQL commands, allowing attackers to inject malicious SQL code. It affects versions prior to 1.7.5, leaving users wide open to exploitation.

What to do

This vulnerability could lead to an attacker executing any SQL command they please, allowing them to read sensitive data, manipulate your database, or even wipe it clean. The potential damage is absolutely devastating! Your entire system's integrity hangs in the balance if this is left unchecked. Immediate action is required: upgrade to Learts Addons version 1.7.5 or later to patch this vulnerability. Additionally, review your input validation practices to ensure that all user inputs are properly sanitized going forward. You've got this! By taking these steps, you can safeguard your database and secure your application like a true security hero! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability
    cvelistv5