CVE-2025-22350

CVE-2025-22350 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the WordPress plugin Ultimate Learning Pro by WpIndeed. The issue impacts all versions from n/a through 3.9 and was published on 2025-01-07T17:15:33.093. It carries a CVSS v3.1 base score of 7.6, reflecting network accessibility, low attack complexity, high privileges required, no user interaction, changed scope, high confidentiality impact, no integrity impact, and low availability impact.

High-privileged remote users (PR:H) can exploit this SQL injection vulnerability over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). Exploitation enables attackers to achieve high confidentiality impact (C:H), such as extracting sensitive data from the database, alongside low availability disruption (A:L), due to the changed scope (S:C).

Mitigation details are provided in the advisory from Patchstack at https://patchstack.com/database/wordpress/plugin/indeed-learning-pro/vulnerability/wordpress-indeed-ultimate-learning-pro-plugin-3-9-sql-injection-vulnerability?_s_id=cve.