CVE-2025-68017CWE-89

WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability

High · published January 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

⚡ The Antideo Email Validator has a Blind SQL Injection vulnerability that could unleash chaos with just a crafty input! 🔥 Think of this like a restaurant where anyone can reorder any dish on the menu without permission, just by writing a note to the chef. If they slip in a secret ingredient list, they could completely change the dish and serve it to unsuspecting diners! An attacker could exploit this vulnerability to extract sensitive data from the database, gaining access to personal information and potentially compromising user accounts. It’s alarming to think that a simple SQL command could turn a trusted application into a data leak!

Put simply

Think of this like a restaurant where anyone can reorder any dish on the menu without permission, just by writing a note to the chef. If they slip in a secret ingredient list, they could completely change the dish and serve it to unsuspecting diners! This vulnerability occurs due to improper neutralization of special elements in SQL commands within Antideo Email Validator, allowing attackers to perform Blind SQL Injection and extract data without direct feedback from the server.

What to do

An attacker could exploit this vulnerability to extract sensitive data from the database, gaining access to personal information and potentially compromising user accounts. It’s alarming to think that a simple SQL command could turn a trusted application into a data leak! Developers need to patch Antideo Email Validator to version 1.0.11 or higher immediately. Additionally, implementing parameterized queries and input validation can help safeguard against similar attacks in the future. You’ve got this! Just follow these steps, and you’ll have this vulnerability locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability
    cvelistv5