CVE-2025-22348

CVE-2025-22348 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the DynamicTags plugin for WordPress, developed by rtowebsites. This flaw affects all versions of the DynamicTags plugin up to and including 1.4.0, as documented in the CVE description published on 2025-01-07.

The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating it can be exploited remotely over the network by an attacker with low privileges, such as an authenticated user, using low-complexity techniques without requiring user interaction. Exploitation allows the attacker to achieve high confidentiality impact by extracting sensitive data from the underlying database through blind SQL injection methods, with a changed scope, no integrity impact, and low availability impact.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/dynamictags/vulnerability/wordpress-dynamictags-plugin-1-4-0-sql-injection-vulnerability?_s_id=cve.