CVE-2025-22507

CVE-2025-22507 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the WordPress plugin iDo8p WPMU Prefill Post (slug: wpmu-prefill-post). The issue impacts all versions from n/a through 1.02, allowing attackers to inject malicious SQL queries due to inadequate input sanitization.

The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating it is exploitable remotely over the network with low attack complexity. Exploitation requires high privileges (PR:H), such as those of an authenticated WordPress administrator, and no user interaction. Successful attacks can result in high confidentiality impact through data exfiltration, low availability disruption, and a changed scope affecting the broader system.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpmu-prefill-post/vulnerability/wordpress-wpmu-prefill-post-plugin-1-02-sql-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations and patch information for affected installations.