CVE-2025-67518CWE-89sql-injection

CVE-2025-67518

High · published December 9, 2025

CVSS v3.1
8.5
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL injection vulnerability in LambertGroup's Accordion Slider PRO could let attackers peek at your database secrets without breaking a sweat! 🚨 Think of this as a restaurant where the chef takes orders blindly, without checking what the customers actually want. If someone whispers a secret ingredient, the chef might accidentally add it to the dish, leading to unexpected flavors – or in this case, data leaks! An attacker could exploit this blind SQL injection to extract sensitive data from your database, leaving your application open to serious compromise. Imagine them siphoning off user credentials or even the entire database—all without you even knowing it’s happening! That's absolutely devastating!

Put simply

Think of this as a restaurant where the chef takes orders blindly, without checking what the customers actually want. If someone whispers a secret ingredient, the chef might accidentally add it to the dish, leading to unexpected flavors – or in this case, data leaks! This SQL injection vulnerability allows attackers to manipulate SQL queries by inserting malicious input, which can lead to unauthorized data access. Specifically, it affects versions of Accordion Slider PRO from n/a through 1.2, allowing for blind SQL injection.

What to do

An attacker could exploit this blind SQL injection to extract sensitive data from your database, leaving your application open to serious compromise. Imagine them siphoning off user credentials or even the entire database—all without you even knowing it’s happening! That's absolutely devastating! To protect yourself, immediately update Accordion Slider PRO to the latest version. Implement input validation and prepared statements to thwart SQL injection attempts, and review your database for any signs of compromise. You’ve got this! Follow these steps to secure your application and boost your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-09T21:18Z
References (1)
EPSS history
Timeline
  • 09 DEC 14:13Z
    WordPress Accordion Slider PRO plugin <= 1.2 - SQL Injection vulnerability
    cvelistv5