CVE-2025-67945CWE-89

WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability

Critical · published January 22, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

🔥 Watch out! There’s a sneaky SQL Injection vulnerability in MailerLite’s WooCommerce integration that could wreak havoc if not patched! Think of it like a restaurant accepting any order without checking if the ingredients are safe — a simple request could lead to a disastrous meal! In this case, attackers can craft SQL commands that manipulate the database without proper filtering, which can be devastating. An attacker could gain full control over your database, potentially accessing, altering, or deleting sensitive customer information. This could lead to severe data breaches and a loss of trust from your customers. The implications are absolutely disastrous for any business relying on this integration!

Put simply

Think of it like a restaurant accepting any order without checking if the ingredients are safe — a simple request could lead to a disastrous meal! In this case, attackers can craft SQL commands that manipulate the database without proper filtering, which can be devastating. The vulnerability arises from improper neutralization of special SQL elements in user inputs, allowing attackers to execute unintended SQL commands that can compromise the database's integrity.

What to do

An attacker could gain full control over your database, potentially accessing, altering, or deleting sensitive customer information. This could lead to severe data breaches and a loss of trust from your customers. The implications are absolutely disastrous for any business relying on this integration! To secure your system, immediately upgrade to the latest version of MailerLite’s WooCommerce integration, ensuring you are beyond version 3.1.2. Additionally, audit your input validation and sanitize all SQL queries to prevent further exploits. You've got this! Follow these steps, and you'll have your security back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability
    cvelistv5