CVE-2025-68561CWE-89sql-injection

CVE-2025-68561

High · published December 23, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

⚡ SQL Injection alert! A sneaky flaw in AutomatorWP versions up to 5.2.4 allows attackers to craft malicious commands – it’s like handing a mischievous guest the keys to your database! 🔑 Imagine you run a restaurant where a customer can subtly change their order without the kitchen checking — that's what SQL Injection allows an attacker to do. If an order slip can be rewritten, the menu (or database) is at their mercy, leading to chaos in the kitchen! An attacker exploiting this vulnerability could manipulate your database with ease — they could read sensitive data, modify records, or even wipe everything clean, creating absolute mayhem! It’s a potential nightmare scenario!

Put simply

Imagine you run a restaurant where a customer can subtly change their order without the kitchen checking — that's what SQL Injection allows an attacker to do. If an order slip can be rewritten, the menu (or database) is at their mercy, leading to chaos in the kitchen! This SQL Injection vulnerability arises from improper handling of special elements in SQL commands, allowing attackers to insert or manipulate queries executed by the database without proper validation.

What to do

An attacker exploiting this vulnerability could manipulate your database with ease — they could read sensitive data, modify records, or even wipe everything clean, creating absolute mayhem! It’s a potential nightmare scenario! To protect yourself, immediately update AutomatorWP to version 5.2.5 or later. Additionally, review your input validation and parameterize SQL queries to reduce risk. Don't let this flaw linger! You’ve got this! With these steps, your defenses will be stronger than ever! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-23T17:15Z
References (1)
EPSS history
Timeline
  • 23 DEC 11:34Z
    WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerability
    cvelistv5