CVE-2025-22527

CVE-2025-22527 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89. It affects the WordPress plugin Mailing Group Listserv (wp-mailing-group) developed by Yamna Khawaja, impacting all versions from n/a through 2.0.9. The vulnerability was published on 2025-01-09.

The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). High-privileged users (PR:H), such as administrators, can exploit it remotely over the network with low attack complexity and no user interaction. Successful exploitation enables high-impact confidentiality violations, such as extracting sensitive data from the database, alongside low availability impact and changed scope, but no integrity impact.

Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-sql-injection-vulnerability?_s_id=cve, detail the SQL injection issue in version 2.0.9 and associated mitigation guidance.